Message ID | 1489206011-43843-1-git-send-email-zlpnobody@163.com |
---|---|
State | Accepted |
Delegated to: | Pablo Neira |
Headers | show |
On Sat, Mar 11, 2017 at 12:20:11PM +0800, Liping Zhang wrote: > From: Liping Zhang <zlpnobody@gmail.com> > > After inputting the following nft command, set->keytype is not initialized > but we try to destroy it, so NULL pointer dereference will happen: > # nft add set t s > Segmentation fault (core dumped) > #0 dtype_free (dtype=0x0) at datatype.c:1049 > #1 set_datatype_destroy (dtype=0x0) at datatype.c:1051 > #2 0x0000000000407f1a in set_free (set=0x838790) at rule.c:213 > #3 0x000000000042ff70 in nft_parse (scanner=scanner@entry=0x8386a0, > state=state@entry=0x7ffc313ea670) at parser_bison.c:9355 > #4 0x000000000040727d in nft_run (scanner=scanner@entry=0x8386a0, > state=state@entry=0x7ffc313ea670, msgs=msgs@entry=0x7ffc313ea660) > at main.c:237 > #5 0x0000000000406e4a in main (argc=<optimized out>, argv=<optimized > out>) at main.c:376 Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/src/datatype.c b/src/datatype.c index c61c424..06a045b 100644 --- a/src/datatype.c +++ b/src/datatype.c @@ -1047,7 +1047,7 @@ const struct datatype *set_datatype_alloc(const struct datatype *orig_dtype, void set_datatype_destroy(const struct datatype *dtype) { - if (dtype->flags & DTYPE_F_CLONE) + if (dtype && dtype->flags & DTYPE_F_CLONE) dtype_free(dtype); } diff --git a/src/rule.c b/src/rule.c index f5ff110..056d5ce 100644 --- a/src/rule.c +++ b/src/rule.c @@ -211,8 +211,7 @@ void set_free(struct set *set) expr_free(set->init); handle_free(&set->handle); set_datatype_destroy(set->keytype); - if (set->datatype) - set_datatype_destroy(set->datatype); + set_datatype_destroy(set->datatype); xfree(set); }