escaped_string_wildcard_expr_alloc() may reallocate the expression. valgrind reports errors like this one: ==29945== Invalid write of size 4 ==29945== at 0x72EE944: __expr_postprocess_string (netlink_delinearize.c:2006) ==29945== by 0x72EE944: expr_postprocess_string (netlink_delinearize.c:2016) ==29945== by 0x72EE944: expr_postprocess (netlink_delinearize.c:2120) ==29945== by 0x72EE5A7: expr_postprocess (netlink_delinearize.c:2094) ==29945== by 0x72EF23B: stmt_expr_postprocess (netlink_delinearize.c:2289) ==29945== by 0x72EF23B: rule_parse_postprocess (netlink_delinearize.c:2510) ==29945== by 0x72EF23B: netlink_delinearize_rule (netlink_delinearize.c:2650) ==29945== by 0x72E6F63: list_rule_cb (netlink.c:330) ==29945== by 0x7770BD3: nftnl_rule_list_foreach (rule.c:810) ==29945== by 0x72E739E: netlink_list_rules (netlink.c:349) ==29945== by 0x72E739E: netlink_list_table (netlink.c:490) ==29945== by 0x72D4A89: cache_init_objects (rule.c:194) ==29945== by 0x72D4A89: cache_init (rule.c:216) ==29945== by 0x72D4A89: cache_update (rule.c:266) ==29945== by 0x72F829E: nft_evaluate (libnftables.c:388) ==29945== by 0x72F8A5B: nft_run_cmd_from_buffer (libnftables.c:428) Remove expr->len, not needed and it triggers use-after-free errors. Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> --- v2: tests/py don't complain anymore. src/netlink_delinearize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 6576687ce627..1f63d9d5e2c2 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -2003,7 +2003,6 @@ static bool __expr_postprocess_string(struct expr **exprp) escaped_string_wildcard_expr_alloc(exprp, len); mpz_clear(tmp); - expr->len = len; return nulterminated; } @@ -2119,6 +2118,7 @@ static void expr_postprocess(struct rule_pp_ctx *ctx, struct expr **exprp) if (expr_basetype(expr)->type == TYPE_STRING) *exprp = expr_postprocess_string(expr); + expr = *exprp; if (expr->dtype->basetype != NULL && expr->dtype->basetype->type == TYPE_BITMASK) *exprp = bitmask_expr_to_binops(expr); -- 2.11.0
