44 lines
1.6 KiB
Diff
44 lines
1.6 KiB
Diff
|
From ee73e9dcd46dc5a1fe3be7caa8b9323819e394b8 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Florian Westphal <fw@strlen.de>
|
||
|
|
Date: Tue, 5 Dec 2023 13:08:17 +0100
|
||
|
|
Subject: [PATCH] evaluate: fix double free on dtype release
|
||
|
|
|
||
|
|
We release ->dtype twice, will either segfault or assert
|
||
|
|
on dtype->refcount != 0 check in datatype_free().
|
||
|
|
|
||
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||
|
|
---
|
||
|
|
src/evaluate.c | 2 +-
|
||
|
|
.../bogons/nft-f/double-free-on-binop-dtype_assert | 6 ++++++
|
||
|
|
2 files changed, 7 insertions(+), 1 deletion(-)
|
||
|
|
create mode 100644 tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert
|
||
|
|
|
||
|
|
diff --git a/src/evaluate.c b/src/evaluate.c
|
||
|
|
index 16ad6473..58cc811a 100644
|
||
|
|
--- a/src/evaluate.c
|
||
|
|
+++ b/src/evaluate.c
|
||
|
|
@@ -1171,7 +1171,7 @@ static int expr_evaluate_prefix(struct eval_ctx *ctx, struct expr **expr)
|
||
|
|
base = prefix->prefix;
|
||
|
|
assert(expr_is_constant(base));
|
||
|
|
|
||
|
|
- prefix->dtype = base->dtype;
|
||
|
|
+ prefix->dtype = datatype_get(base->dtype);
|
||
|
|
prefix->byteorder = base->byteorder;
|
||
|
|
prefix->len = base->len;
|
||
|
|
prefix->flags |= EXPR_F_CONSTANT;
|
||
|
|
diff --git a/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert
|
||
|
|
new file mode 100644
|
||
|
|
index 00000000..b7a9a1cc
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert
|
||
|
|
@@ -0,0 +1,6 @@
|
||
|
|
+table inet t {
|
||
|
|
+ chain c {
|
||
|
|
+ udp length . @th,160,118 vmap { 47-63 . 0xe3731353631303331313037353532/3 : accept }
|
||
|
|
+ jump noexist # only here so this fails to load after patch.
|
||
|
|
+ }
|
||
|
|
+}
|
||
|
|
--
|
||
|
|
2.33.0
|
||
|
|
|