From: Liping Zhang <zlpnobody@xxxxxxxxx>
After inputting the following nft command, set->keytype is not initialized
but we try to destroy it, so NULL pointer dereference will happen:
# nft add set t s
Segmentation fault (core dumped)
#0 dtype_free (dtype=0x0) at datatype.c:1049
#1 set_datatype_destroy (dtype=0x0) at datatype.c:1051
#2 0x0000000000407f1a in set_free (set=0x838790) at rule.c:213
#3 0x000000000042ff70 in nft_parse (scanner=scanner@entry=0x8386a0,
state=state@entry=0x7ffc313ea670) at parser_bison.c:9355
#4 0x000000000040727d in nft_run (scanner=scanner@entry=0x8386a0,
state=state@entry=0x7ffc313ea670, msgs=msgs@entry=0x7ffc313ea660)
at main.c:237
#5 0x0000000000406e4a in main (argc=<optimized out>, argv=<optimized
out>) at main.c:376
Fixes: b9b6092304ae ("evaluate: store byteorder for set keys")
Signed-off-by: Liping Zhang <zlpnobody@xxxxxxxxx>
---
src/datatype.c | 2 +-
src/rule.c | 3 +--
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/src/datatype.c b/src/datatype.c
index c61c424..06a045b 100644
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -1047,7 +1047,7 @@ const struct datatype *set_datatype_alloc(const struct datatype *orig_dtype,
void set_datatype_destroy(const struct datatype *dtype)
{
- if (dtype->flags & DTYPE_F_CLONE)
+ if (dtype && dtype->flags & DTYPE_F_CLONE)
dtype_free(dtype);
}
diff --git a/src/rule.c b/src/rule.c
index f5ff110..056d5ce 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -211,8 +211,7 @@ void set_free(struct set *set)
expr_free(set->init);
handle_free(&set->handle);
set_datatype_destroy(set->keytype);
- if (set->datatype)
- set_datatype_destroy(set->datatype);
+ set_datatype_destroy(set->datatype);
xfree(set);
}
--
2.5.5
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
