Projects
Mega:24.03
nftables
_service:tar_scm:backport-evaluate-fix-double-f...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:backport-evaluate-fix-double-free-on-dtype-release.patch of Package nftables
From ee73e9dcd46dc5a1fe3be7caa8b9323819e394b8 Mon Sep 17 00:00:00 2001 From: Florian Westphal <fw@strlen.de> Date: Tue, 5 Dec 2023 13:08:17 +0100 Subject: [PATCH] evaluate: fix double free on dtype release We release ->dtype twice, will either segfault or assert on dtype->refcount != 0 check in datatype_free(). Signed-off-by: Florian Westphal <fw@strlen.de> --- src/evaluate.c | 2 +- .../bogons/nft-f/double-free-on-binop-dtype_assert | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert diff --git a/src/evaluate.c b/src/evaluate.c index 16ad6473..58cc811a 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1171,7 +1171,7 @@ static int expr_evaluate_prefix(struct eval_ctx *ctx, struct expr **expr) base = prefix->prefix; assert(expr_is_constant(base)); - prefix->dtype = base->dtype; + prefix->dtype = datatype_get(base->dtype); prefix->byteorder = base->byteorder; prefix->len = base->len; prefix->flags |= EXPR_F_CONSTANT; diff --git a/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert new file mode 100644 index 00000000..b7a9a1cc --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert @@ -0,0 +1,6 @@ +table inet t { + chain c { + udp length . @th,160,118 vmap { 47-63 . 0xe3731353631303331313037353532/3 : accept } + jump noexist # only here so this fails to load after patch. + } +} -- 2.33.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2