diff options
author | Marcos Paulo de Souza <marcos.souza.org@gmail.com> | 2017-07-24 21:55:08 -0300 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2017-07-25 03:06:29 +0200 |
commit | e870432649955d377a73ee5a72cb23f0f6b5e4c5 (patch) | |
tree | d5782abbd48d8a4cc464ab1bf71d255e808b7a79 | |
parent | b266523a03a282eabb76b46013ba43f7e47929c2 (diff) |
labels: don't crash on NULL labelmap
When CONNLABEL_CFG isn't available (/etc/xtables/connlabel.conf),
conntrack tool crashes:
[marcos@Icarus ~]$ conntrack -l something
nfct_labelmap_new: No such file or directory
Segmentation fault (core dumped)
I can see this problem in Fedora 26, because connlabel.conf does not
come along the conntrack/libnetfilter packages. This problem happens because
conntrack calls nfct_labelmap_new, which resides on
libnetfilter_conntrack. So this lib returns NULL because CONNLABEL_CFG
is not present, and then NULL is assigned to the global var called
labelmap on conntrack. Later, get_label is called, passing NULL to the
library, and __label_get_bit is called and deferences labelmap without
check, which leads to a crash.
With this patch the crash does not happen anymore,
and an error message is displayed:
conntrack -l something
nfct_labelmap_new: No such file or directory
conntrack v1.4.4 (conntrack-tools): unknown label 'something'
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
-rw-r--r-- | src/conntrack/labels.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/conntrack/labels.c b/src/conntrack/labels.c index 8048076..ef85b6e 100644 --- a/src/conntrack/labels.c +++ b/src/conntrack/labels.c @@ -51,8 +51,14 @@ static unsigned int hash_name(const char *name) int __labelmap_get_bit(struct nfct_labelmap *m, const char *name) { - unsigned int i = hash_name(name); - struct labelmap_bucket *list = m->map_name[i]; + struct labelmap_bucket *list; + unsigned int i; + + if (!m) + return -1; + + i = hash_name(name); + list = m->map_name[i]; while (list) { if (strcmp(name, list->name) == 0) |