path: root/src/conntrack/api.c
diff options
authorFlorian Westphal <>2012-11-19 22:39:55 +0100
committerFlorian Westphal <>2012-11-28 22:00:06 +0100
commit525aa06da786f66709db4e1ec17bd635b8c5025a (patch)
tree1d546819294eaed4368c14b2deb55a214e6c3fa0 /src/conntrack/api.c
parent4984b297a3fa6f79ab9162617b9c90aca76d6f70 (diff)
conntrack: fix nfct_clone with certain attribute data types
some attributes are pointers to malloc'd objects. Simply copying the pointer results in use-after free when the original or the clone is destroyed. Fix it by using nfct_copy instead of memcpy and add proper test case for cloned objects: - nfct_cmp of orig and clone should return 1 (equal) - freeing both the original and the clone should neither leak memory nor result in double-frees. the testsuite changes revealed a few more problems: - ct1->timeout == ct2->timeout returned 0, ie. same timeout was considered "not equal" by nfct_cmp - secctx comparision causes "Invalid address" valgrind warnings when pointer is NULL - NFCT_CP_OVERRIDE did not handle helper attribute and erronously freed ct1 secctx memory. While at it, bump qa_test data dummy to 256 (else, valgrind complains about move-depends-on-uninitialized-memory). Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL. Signed-off-by: Florian Westphal <>
Diffstat (limited to 'src/conntrack/api.c')
1 files changed, 1 insertions, 1 deletions
diff --git a/src/conntrack/api.c b/src/conntrack/api.c
index 000571f..0bc2091 100644
--- a/src/conntrack/api.c
+++ b/src/conntrack/api.c
@@ -147,7 +147,7 @@ struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct)
if ((clone = nfct_new()) == NULL)
return NULL;
- memcpy(clone, ct, sizeof(*ct));
+ nfct_copy(clone, ct, NFCT_CP_OVERRIDE);
return clone;