On Thu, Jul 16, 2015 at 03:39:29PM +0200, Florian Westphal wrote:
> Hi Pablo
>
> 09565a4b1ed4863d44c4509a93c50f44efd12771
> (netlink_delinearize: consolidate range printing) causes nft
> to segfault on 32bit machine when printing l4proto ranges.
>
> The problem is that meta_expr_pctx_update() assumes that
> right is a value, but after this change it can also be a value.
>
> Thus, expr->value contents are undefined (its union).
> On x86_64 this is also broken but by virtue of struct layout
> and pointer sizes, value->_mp_size will almost always be 0
> so mpz_get_uint8() returns 0.
>
> But on x86-32 _mp_size will be huge value (contains expr->right pointer
> of range), so we crash in libgmp.
Good catch. Could you give a try to this patch instead?
We shouldn't call pctx_update(), before the transformation we had
there a expr->op == { OP_GT, OP_GTE, OP_LT, OP_LTE }. So we never
entered that path as the assert in payload_expr_pctx_update()
indicates.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
