On Fri, Jan 10, 2014 at 11:15:04AM +0100, Pablo Neira Ayuso wrote: > On Fri, Jan 10, 2014 at 10:02:46AM +0000, Patrick McHardy wrote: > > On Fri, Jan 10, 2014 at 10:52:47AM +0100, Pablo Neira Ayuso wrote: > [...] > > > So integer_type_parse() returns NULL, note that **res is left > > > uninitialized. > > > > Right, but only if invoked from an upper layer datatype. This needs to > > make sure we don't return NULL without an erec. This was actually a bug > > in the meta expression that I just posted a fix for. > > > > > Going back to expr_evaluate_symbol(), since NULL is returned, it > > > assumes that an expression has been allocated. > > > > > > I guess this doesn't crash all the time as we're relying on an > > > uninitialized memory area and we can argue that the fix may not be > > > optimal, but I really think this is fixing something. > > > > Well, the proper fix seems to be to initialize *res to NULL in meta > > before invoking the integer type parsing function. > > I guess you mean this patch: http://patchwork.ozlabs.org/patch/309211/ Correct. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
