From 5dd19ef301a9c92beb470099df0a76e33a614173 Mon Sep 17 00:00:00 2001 From: Alvaro Neira Date: Tue, 24 Feb 2015 09:10:32 +0100 Subject: ruleset: fix crash if we free sets included in the set_list When we parse a ruleset which has a rule using a set. First step is to parse the set, set up an ID and add it to a set list. Later, we use this set list to find the set associated to the rule and we set up the set ID to the expression (lookup expression) of the rule. The problem is that if we return this set to the callback function nft_ruleset_parse_file_cb() and we free this set, we have a crash when we try to iterate in the set list. This patch solves it, cloning the set and adding the new set to the set list. Signed-off-by: Alvaro Neira Ayuso Signed-off-by: Pablo Neira Ayuso --- src/set_elem.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'src/set_elem.c') diff --git a/src/set_elem.c b/src/set_elem.c index 25cd951..e822acc 100644 --- a/src/set_elem.c +++ b/src/set_elem.c @@ -161,6 +161,22 @@ uint32_t nft_set_elem_attr_get_u32(struct nft_set_elem *s, uint16_t attr) } EXPORT_SYMBOL(nft_set_elem_attr_get_u32); +struct nft_set_elem *nft_set_elem_clone(struct nft_set_elem *elem) +{ + struct nft_set_elem *newelem; + + newelem = nft_set_elem_alloc(); + if (newelem == NULL) + return NULL; + + memcpy(newelem, elem, sizeof(*elem)); + + if (elem->flags & (1 << NFT_SET_ELEM_ATTR_CHAIN)) + newelem->data.chain = strdup(elem->data.chain); + + return newelem; +} + void nft_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_set_elem *e) { -- cgit v1.2.3