build: add attribute header size to total attribute length

This patch adds the size of the attribute header (4 bytes) to the
length field of netattr. This fixes a possible invalid memory
access in malformed messages.

This change is included in the set of scheduled changes for 0.9.9
that break backward compatibility.

This patch also removes a memset of 4096 by one to initialize
the headers and the netattr paddings.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 5 insertions, 2 deletions

diff --git a/src/build.c b/src/build.c
index 5143048..c776de8 100644
--- a/src/build.c
+++ b/src/build.c
@@ -24,9 +24,12 @@ static inline void *
 put_header(struct netpld *pld, int attr, size_t len)
 {
 	struct netattr *nta = PLD_TAIL(pld);
-	pld->len += NTA_ALIGN(NTA_LENGTH(len));
+	int total_size = NTA_ALIGN(NTA_LENGTH(len));
+	int attr_size = NTA_LENGTH(len);
+	pld->len += total_size;
 	nta->nta_attr = htons(attr);
-	nta->nta_len = htons(len);
+	nta->nta_len = htons(attr_size);
+	memset((unsigned char *)nta + attr_size, 0, total_size - attr_size);
 	return NTA_DATA(nta);
 }