| Message ID | 1471017610-3473-3-git-send-email-phil@nwl.cc |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
On Fri, Aug 12, 2016 at 06:00:08PM +0200, Phil Sutter wrote: > As netlink_get_register() may return NULL, we must not pass the returned > data unchecked to expr_set_type() as that will dereference it. Since the > parser has failed at that point anyway, by returning early we can skip > the useless statement allocation that follows in > netlink_parse_ct_stmt(). > > Signed-off-by: Phil Sutter <phil@nwl.cc> > --- > src/netlink_delinearize.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c > index 12d0b4a277795..6ac2e9690fd39 100644 > --- a/src/netlink_delinearize.c > +++ b/src/netlink_delinearize.c > @@ -518,6 +518,8 @@ static void netlink_parse_ct_stmt(struct netlink_parse_ctx *ctx, > > sreg = netlink_parse_register(nle, NFTNL_EXPR_CT_SREG); > expr = netlink_get_register(ctx, loc, sreg); > + if (!expr) > + return; I would add a netlink_error() by here too. I can see more spots with this problem, would you send us a patch to resolve the multiple reincarnations of this problem in one go? Thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 12d0b4a277795..6ac2e9690fd39 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -518,6 +518,8 @@ static void netlink_parse_ct_stmt(struct netlink_parse_ctx *ctx, sreg = netlink_parse_register(nle, NFTNL_EXPR_CT_SREG); expr = netlink_get_register(ctx, loc, sreg); + if (!expr) + return; key = nftnl_expr_get_u32(nle, NFTNL_EXPR_CT_KEY); stmt = ct_stmt_alloc(loc, key, expr);
As netlink_get_register() may return NULL, we must not pass the returned data unchecked to expr_set_type() as that will dereference it. Since the parser has failed at that point anyway, by returning early we can skip the useless statement allocation that follows in netlink_parse_ct_stmt(). Signed-off-by: Phil Sutter <phil@nwl.cc> --- src/netlink_delinearize.c | 2 ++ 1 file changed, 2 insertions(+)