[conntrack-tools PATCH 4/4] conntrack: Sanitize free_tmpl_objects()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The function unconditionally dereferenced its parameter, yet it is
possible for the passed 'cur_tmpl' pointer when called from exit_error()
to be still NULL: It is assigned to by alloc_tmpl_objects() at start of
do_parse(), though callers of that function might call exit_error() in
beforehand.

Fixes: 258b4540f4512 ("conntrack: add struct ct_tmpl")
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
 src/conntrack.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/conntrack.c b/src/conntrack.c
index 2bd71e17e6be6..23eaf274a78a1 100644
--- a/src/conntrack.c
+++ b/src/conntrack.c
@@ -139,6 +139,8 @@ static int alloc_tmpl_objects(struct ct_tmpl *tmpl)
 
 static void free_tmpl_objects(struct ct_tmpl *tmpl)
 {
+	if (!tmpl)
+		return;
 	if (tmpl->ct)
 		nfct_destroy(tmpl->ct);
 	if (tmpl->exptuple)
-- 
2.38.0




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux