Re: [PATCH] rule: fix out of memory write if num_stmts is too low

[Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>]

On Mon, May 04, 2020 at 10:48:58PM +0200, Michael Braun wrote:
> Running bridge/vlan.t with ASAN, results in the following error.
> This patch fixes this
> 
> flush table bridge test-bridge
> add rule bridge test-bridge input vlan id 1 ip saddr 10.0.0.1

Thanks for your patch. Probably this patch instead?

diff --git a/src/evaluate.c b/src/evaluate.c
index 597141317000..26dfba2c6a74 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -645,6 +645,12 @@ static bool proto_is_dummy(const struct proto_desc *desc)
 	return desc == &proto_inet || desc == &proto_netdev;
 }
 
+static void ctx_stmt_add(struct eval_ctx *ctx, struct stmt *nstmt)
+{
+	list_add_tail(&nstmt->list, &ctx->stmt->list);
+	ctx->rule->num_stmts++;
+}
+
 static int resolve_protocol_conflict(struct eval_ctx *ctx,
 				     const struct proto_desc *desc,
 				     struct expr *payload)
@@ -659,7 +665,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx,
 		if (err < 0)
 			return err;
 
-		list_add_tail(&nstmt->list, &ctx->stmt->list);
+		ctx_stmt_add(ctx, nstmt);
 	}
 
 	assert(base <= PROTO_BASE_MAX);
@@ -673,7 +679,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx,
 		return 1;
 
 	payload->payload.offset += ctx->pctx.protocol[base].offset;
-	list_add_tail(&nstmt->list, &ctx->stmt->list);
+	ctx_stmt_add(ctx, nstmt);
 
 	return 0;
 }
@@ -698,7 +704,8 @@ static int __expr_evaluate_payload(struct eval_ctx *ctx, struct expr *expr)
 	if (desc == NULL) {
 		if (payload_gen_dependency(ctx, payload, &nstmt) < 0)
 			return -1;
-		list_add_tail(&nstmt->list, &ctx->stmt->list);
+
+		ctx_stmt_add(ctx, nstmt);
 	} else {
 		/* No conflict: Same payload protocol as context, adjust offset
 		 * if needed.
@@ -841,7 +848,7 @@ static int ct_gen_nh_dependency(struct eval_ctx *ctx, struct expr *ct)
 
 	nstmt = expr_stmt_alloc(&dep->location, dep);
 
-	list_add_tail(&nstmt->list, &ctx->stmt->list);
+	ctx_stmt_add(ctx, nstmt);
 	return 0;
 }