packages/libnftnl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!39 set: Do not leave free'd expr_list elements in place

Browse Source 
From: @tong_1001 
Reviewed-by: @hubin95 
Signed-off-by: @hubin95
This commit is contained in:
openeuler-ci-bot 2023-09-05 12:32:51 +00:00 committed by Gitee
commit 0b21af91a1
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 78 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
backport-set-Do-not-leave-free-d-expr_list-elements-in-place.patch Normal file
View File

@ -0,0 +1,69 @@
From 2d83a7d4f58fbf6eaa9aeace49c78d91a86a3b28 Mon Sep 17 00:00:00 2001
From: Phil Sutter <phil@nwl.cc>
Date: Wed, 31 May 2023 14:09:09 +0200
Subject: [PATCH] set: Do not leave free'd expr_list elements in place
When freeing elements, remove them also to prevent a potential UAF.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1685
Fixes: 3469f09286cee ("src: add NFTNL_SET_EXPRESSIONS")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
src/set.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/src/set.c b/src/set.c
index c46f827..719e596 100644
--- a/src/set.c
+++ b/src/set.c
@@ -54,8 +54,10 @@ void nftnl_set_free(const struct nftnl_set *s)
if (s->flags & (1 << NFTNL_SET_USERDATA))
xfree(s->user.data);
- list_for_each_entry_safe(expr, next, &s->expr_list, head)
+ list_for_each_entry_safe(expr, next, &s->expr_list, head) {
+ list_del(&expr->head);
nftnl_expr_free(expr);
+ }
list_for_each_entry_safe(elem, tmp, &s->element_list, head) {
list_del(&elem->head);
@@ -105,8 +107,10 @@ void nftnl_set_unset(struct nftnl_set *s, uint16_t attr)
break;
case NFTNL_SET_EXPR:
case NFTNL_SET_EXPRESSIONS:
- list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+ list_for_each_entry_safe(expr, tmp, &s->expr_list, head) {
+ list_del(&expr->head);
nftnl_expr_free(expr);
+ }
break;
default:
return;
@@ -210,8 +214,10 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data,
s->user.len = data_len;
break;
case NFTNL_SET_EXPR:
- list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+ list_for_each_entry_safe(expr, tmp, &s->expr_list, head) {
+ list_del(&expr->head);
nftnl_expr_free(expr);
+ }
expr = (void *)data;
list_add(&expr->head, &s->expr_list);
@@ -742,8 +748,10 @@ int nftnl_set_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_set *s)
return 0;
out_set_expr:
- list_for_each_entry_safe(expr, next, &s->expr_list, head)
+ list_for_each_entry_safe(expr, next, &s->expr_list, head) {
+ list_del(&expr->head);
nftnl_expr_free(expr);
+ }
return -1;
}
--
2.27.0

10
libnftnl.spec
View File

@ -1,11 +1,13 @@
Name: libnftnl
Version: 1.2.6
Release: 1
Release: 2
Summary: Library for low-level interaction with nftables Netlink's API over libmnl
License: GPLv2+
URL: http://netfilter.org/projects/libnftnl/
Source0: http://netfilter.org/projects/libnftnl/files/%{name}-%{version}.tar.xz
Patch6000: backport-set-Do-not-leave-free-d-expr_list-elements-in-place.patch
BuildRequires: libmnl-devel jansson-devel gcc
# replace old libnftables package
@ -51,6 +53,12 @@ make %{?_smp_mflags} check
%{_includedir}/libnftnl
%changelog
* Tue Sep 05 2023 shixuantong <shixuantong1@huawei.com> - 1.2.6-2
- Type:bugfix
- ID:NA
- SUG:NA
- DESC:set: Do not leave free'd expr_list elements in place
* Mon Jul 17 2023 zhangchenglin <zhangchenglin@kylinos.cn> - 1.2.6-1
- Type:enhancement
- ID:NA