diff options
author | Phil Sutter <phil@nwl.cc> | 2023-05-31 14:09:09 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-07-13 19:55:02 +0200 |
commit | 3eaa940bc33a3186dc7ba1e30640ec79b5f261b9 (patch) | |
tree | 850cb0723026fbffb867c75d9a001f752bb12492 /src/set.c | |
parent | 83dd4dc316b4189d16ead54cd30bfc89e5160cfd (diff) |
set: Do not leave free'd expr_list elements in place
When freeing elements, remove them also to prevent a potential UAF.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1685
Fixes: 3469f09286cee ("src: add NFTNL_SET_EXPRESSIONS")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'src/set.c')
-rw-r--r-- | src/set.c | 16 |
1 files changed, 12 insertions, 4 deletions
@@ -54,8 +54,10 @@ void nftnl_set_free(const struct nftnl_set *s) if (s->flags & (1 << NFTNL_SET_USERDATA)) xfree(s->user.data); - list_for_each_entry_safe(expr, next, &s->expr_list, head) + list_for_each_entry_safe(expr, next, &s->expr_list, head) { + list_del(&expr->head); nftnl_expr_free(expr); + } list_for_each_entry_safe(elem, tmp, &s->element_list, head) { list_del(&elem->head); @@ -105,8 +107,10 @@ void nftnl_set_unset(struct nftnl_set *s, uint16_t attr) break; case NFTNL_SET_EXPR: case NFTNL_SET_EXPRESSIONS: - list_for_each_entry_safe(expr, tmp, &s->expr_list, head) + list_for_each_entry_safe(expr, tmp, &s->expr_list, head) { + list_del(&expr->head); nftnl_expr_free(expr); + } break; default: return; @@ -210,8 +214,10 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data, s->user.len = data_len; break; case NFTNL_SET_EXPR: - list_for_each_entry_safe(expr, tmp, &s->expr_list, head) + list_for_each_entry_safe(expr, tmp, &s->expr_list, head) { + list_del(&expr->head); nftnl_expr_free(expr); + } expr = (void *)data; list_add(&expr->head, &s->expr_list); @@ -742,8 +748,10 @@ int nftnl_set_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_set *s) return 0; out_set_expr: - list_for_each_entry_safe(expr, next, &s->expr_list, head) + list_for_each_entry_safe(expr, next, &s->expr_list, head) { + list_del(&expr->head); nftnl_expr_free(expr); + } return -1; } |