diff mbox

[nft,3/4] proto_find_num: Avoid potential null pointer dereference

Message ID 1471017610-3473-4-git-send-email-phil@nwl.cc
State Changes Requested
Delegated to: Pablo Neira
Headers show

Commit Message

Phil Sutter Aug. 12, 2016, 4 p.m. UTC
When being called from stmt_evaluate_reset(), it seems that 'base' might
actually be NULL, so better make sure it is not in proto_find_num().

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
This might be invalid in that if 'base' is NULL, ctx->pctx.family is
always either NFPROTO_INET or NFPROTO_BRIDGE. But if so, the
corresponding check in stmt_evaluate_reset() may be simplified to just
having 'base' falling back to &proto_inet_service.
---
 src/proto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Pablo Neira Ayuso Aug. 17, 2016, 2:47 p.m. UTC | #1
On Fri, Aug 12, 2016 at 06:00:09PM +0200, Phil Sutter wrote:
> When being called from stmt_evaluate_reset(), it seems that 'base' might
> actually be NULL, so better make sure it is not in proto_find_num().

I would suggest you address this from stmt_evaluate_reset().
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/src/proto.c b/src/proto.c
index 4c12977cef082..d9210afeaf256 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -75,7 +75,7 @@  int proto_find_num(const struct proto_desc *base,
 {
 	unsigned int i;
 
-	for (i = 0; i < array_size(base->protocols); i++) {
+	for (i = 0; base && i < array_size(base->protocols); i++) {
 		if (base->protocols[i].desc == desc)
 			return base->protocols[i].num;
 	}