diff options
| author | Florian Westphal <fw@strlen.de> | 2023-12-04 22:00:06 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-12-12 13:30:09 +0100 |
| commit | 31d874c2e45958af8f3ed6015d6ab8626ab0e48b (patch) | |
| tree | 20859e92fa4a34ea8cc85d06053e6244220a2d50 | |
| parent | 972ee91aebd81d9312d84b3ac7ffccce7e35b5d1 (diff) | |
evaluate: reject attempt to update a set
commit 5f43ea807bb0f5b30f332c2c96f13e33c9243d22 upstream.
This will crash as set->data is NULL, so check that SET_REF is pointing
to a map:
Error: candidates_ipv4 is not a map
tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10 :0004 timeout 1s }
~~~~~~~~~~~~~~~~
Signed-off-by: Florian Westphal <fw@strlen.de>
| -rw-r--r-- | src/evaluate.c | 4 | ||||
| -rw-r--r-- | tests/shell/testcases/bogons/nft-f/add_to_a_set_crash | 11 |
2 files changed, 15 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 777daa43..639bc012 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -4066,6 +4066,10 @@ static int stmt_evaluate_map(struct eval_ctx *ctx, struct stmt *stmt) return expr_error(ctx->msgs, stmt->map.set, "Expression does not refer to a set"); + if (!set_is_map(stmt->map.set->set->flags)) + return expr_error(ctx->msgs, stmt->map.set, + "%s is not a map", stmt->map.set->set->handle.set.name); + if (stmt_evaluate_key(ctx, stmt, stmt->map.set->set->key->dtype, stmt->map.set->set->key->len, diff --git a/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash b/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash new file mode 100644 index 00000000..80a01b45 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash @@ -0,0 +1,11 @@ +table t { + set candidates_ipv4 { + type ipv4_addr . inet_service + size 65535 + flags dynamic,timeout + } + + chain input { + tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10 :0004 timeout 1s } + } +} |