summaryrefslogtreecommitdiffstats
path: root/src/rule.c
diff options
context:
space:
mode:
authorLiping Zhang <zlpnobody@gmail.com>2017-03-11 12:20:11 +0800
committerPablo Neira Ayuso <pablo@netfilter.org>2017-03-13 12:11:44 +0100
commitc6cd7c22548a545ea9a831a1ea725d1716295b4a (patch)
tree07ac30f3364115c3eff3cd90ba195223eeeb3563 /src/rule.c
parente02bd59c4009bedba89da88b199e715441975439 (diff)
src: fix crash when inputting an incomplete set add command
After inputting the following nft command, set->keytype is not initialized but we try to destroy it, so NULL pointer dereference will happen: # nft add set t s Segmentation fault (core dumped) #0 dtype_free (dtype=0x0) at datatype.c:1049 #1 set_datatype_destroy (dtype=0x0) at datatype.c:1051 #2 0x0000000000407f1a in set_free (set=0x838790) at rule.c:213 #3 0x000000000042ff70 in nft_parse (scanner=scanner@entry=0x8386a0, state=state@entry=0x7ffc313ea670) at parser_bison.c:9355 #4 0x000000000040727d in nft_run (scanner=scanner@entry=0x8386a0, state=state@entry=0x7ffc313ea670, msgs=msgs@entry=0x7ffc313ea660) at main.c:237 #5 0x0000000000406e4a in main (argc=<optimized out>, argv=<optimized out>) at main.c:376 Fixes: b9b6092304ae ("evaluate: store byteorder for set keys") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/rule.c')
-rw-r--r--src/rule.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/src/rule.c b/src/rule.c
index f5ff1103..056d5ce8 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -211,8 +211,7 @@ void set_free(struct set *set)
expr_free(set->init);
handle_free(&set->handle);
set_datatype_destroy(set->keytype);
- if (set->datatype)
- set_datatype_destroy(set->datatype);
+ set_datatype_destroy(set->datatype);
xfree(set);
}