On Fri, Jan 10, 2014 at 10:02:46AM +0000, Patrick McHardy wrote: > On Fri, Jan 10, 2014 at 10:52:47AM +0100, Pablo Neira Ayuso wrote: [...] > > So integer_type_parse() returns NULL, note that **res is left > > uninitialized. > > Right, but only if invoked from an upper layer datatype. This needs to > make sure we don't return NULL without an erec. This was actually a bug > in the meta expression that I just posted a fix for. > > > Going back to expr_evaluate_symbol(), since NULL is returned, it > > assumes that an expression has been allocated. > > > > I guess this doesn't crash all the time as we're relying on an > > uninitialized memory area and we can argue that the fix may not be > > optimal, but I really think this is fixing something. > > Well, the proper fix seems to be to initialize *res to NULL in meta > before invoking the integer type parsing function. I guess you mean this patch: http://patchwork.ozlabs.org/patch/309211/ I just think that patch descriptions should point to each other or be reworded as the revert is taking as back to a crash that is fixed (in a much more generic/nicer way) by your follow-up patch. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
