From patchwork Mon Jun 10 15:34:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1113148 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45Mxyp60sLz9sCJ for ; Tue, 11 Jun 2019 01:34:58 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390508AbfFJPe5 (ORCPT ); Mon, 10 Jun 2019 11:34:57 -0400 Received: from mail.us.es ([193.147.175.20]:36178 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390415AbfFJPe5 (ORCPT ); Mon, 10 Jun 2019 11:34:57 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 4968820A52A for ; Mon, 10 Jun 2019 17:34:55 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 3A102DA707 for ; Mon, 10 Jun 2019 17:34:55 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 2FAB8DA708; Mon, 10 Jun 2019 17:34:55 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 31DDBDA707 for ; Mon, 10 Jun 2019 17:34:53 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Mon, 10 Jun 2019 17:34:53 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from salvia.here (sys.soleta.eu [212.170.55.40]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 1957F4265A31 for ; Mon, 10 Jun 2019 17:34:53 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft 2/2] netlink_delinearize: release expression before calling netlink_parse_concat_expr() Date: Mon, 10 Jun 2019 17:34:49 +0200 Message-Id: <20190610153449.9199-2-pablo@netfilter.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20190610153449.9199-1-pablo@netfilter.org> References: <20190610153449.9199-1-pablo@netfilter.org> X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org netlink_get_register() clones the expression in the register. Release this expression before calling netlink_parse_concat_expr() to deconstruct the concatenation. ==15069== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==15069== by 0x4E79508: xmalloc (utils.c:36) ==15069== by 0x4E795ED: xzalloc (utils.c:65) ==15069== by 0x4E6029B: dtype_alloc (datatype.c:1073) ==15069== by 0x4E6029B: concat_type_alloc (datatype.c:1127) ==15069== by 0x4E6D3B3: netlink_delinearize_set (netlink.c:578) ==15069== by 0x4E6D68E: list_set_cb (netlink.c:648) ==15069== by 0x5F34023: nftnl_set_list_foreach (set.c:780) ==15069== by 0x4E6D6F3: netlink_list_sets (netlink.c:669) ==15069== by 0x4E5A7A3: cache_init_objects (rule.c:159) ==15069== by 0x4E5A7A3: cache_init (rule.c:216) ==15069== by 0x4E5A7A3: cache_update (rule.c:266) ==15069== by 0x4E7E09E: nft_evaluate (libnftables.c:388) ==15069== by 0x4E7E85B: nft_run_cmd_from_buffer (libnftables.c:428) Signed-off-by: Pablo Neira Ayuso --- src/netlink_delinearize.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index a1c775e679e4..0270e1fd7067 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -293,6 +293,7 @@ static void netlink_parse_cmp(struct netlink_parse_ctx *ctx, expr_basetype(left) != &string_type) { return netlink_error(ctx, loc, "Relational expression size mismatch"); } else if (left->len > 0 && left->len < right->len) { + expr_free(left); left = netlink_parse_concat_expr(ctx, loc, sreg, right->len); if (left == NULL) return; @@ -329,6 +330,7 @@ static void netlink_parse_lookup(struct netlink_parse_ctx *ctx, "Lookup expression has no left hand side"); if (left->len < set->key->len) { + expr_free(left); left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len); if (left == NULL) return; @@ -1317,6 +1319,7 @@ static void netlink_parse_dynset(struct netlink_parse_ctx *ctx, "Dynset statement has no key expression"); if (expr->len < set->key->len) { + expr_free(expr); expr = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len); if (expr == NULL) return; @@ -1408,6 +1411,7 @@ static void netlink_parse_objref(struct netlink_parse_ctx *ctx, "objref expression has no left hand side"); if (left->len < set->key->len) { + expr_free(left); left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len); if (left == NULL) return;