On Thu, Jul 16, 2015 at 06:54:05PM +0200, Pablo Neira Ayuso wrote:
> On Thu, Jul 16, 2015 at 03:39:29PM +0200, Florian Westphal wrote:
> > Hi Pablo
> >
> > 09565a4b1ed4863d44c4509a93c50f44efd12771
> > (netlink_delinearize: consolidate range printing) causes nft
> > to segfault on 32bit machine when printing l4proto ranges.
> >
> > The problem is that meta_expr_pctx_update() assumes that
> > right is a value, but after this change it can also be a value.
> >
> > Thus, expr->value contents are undefined (its union).
> > On x86_64 this is also broken but by virtue of struct layout
> > and pointer sizes, value->_mp_size will almost always be 0
> > so mpz_get_uint8() returns 0.
> >
> > But on x86-32 _mp_size will be huge value (contains expr->right pointer
> > of range), so we crash in libgmp.
>
> Good catch. Could you give a try to this patch instead?
>
> We shouldn't call pctx_update(), before the transformation we had
> there a expr->op == { OP_GT, OP_GTE, OP_LT, OP_LTE }. So we never
> entered that path as the assert in payload_expr_pctx_update()
> indicates.
Forgot patch, here it comes.
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 6d60be3..4226b82 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -983,6 +983,9 @@ static void meta_match_postprocess(struct rule_pp_ctx *ctx,
switch (expr->op) {
case OP_EQ:
+ if (expr->right->ops->type == EXPR_RANGE)
+ break;
+
expr->left->ops->pctx_update(&ctx->pctx, expr);
if (ctx->pbase == PROTO_BASE_INVALID &&
