diff options
author | Phil Sutter <phil@nwl.cc> | 2018-03-01 15:00:30 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-03-02 11:46:56 +0100 |
commit | 5043a1e4847c0149dabaf0b529a14a43b957e5e4 (patch) | |
tree | 432182f08b2ebf9f1a415982c406e87f1f2952e3 /src | |
parent | edcf3adcf4c4cf58cb0b965b984a512b12181a58 (diff) |
hash: Fix potential null-pointer dereference in hash_expr_cmp()
The first part of the conditional:
| (e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr))
will call expr_cmp() in case e1->hash.expr is NULL, causing null-pointer
dereference. This is probably a typo, the intention when introducing
this was to avoid the call to expr_cmp() for symmetric hash expressions
which don't use expr->hash.expr. Inverting the existence check should
fix this.
Fixes: 3a86406729782 ("src: hash: support of symmetric hash")
Cc: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
-rw-r--r-- | src/hash.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -36,7 +36,7 @@ static void hash_expr_print(const struct expr *expr, struct output_ctx *octx) static bool hash_expr_cmp(const struct expr *e1, const struct expr *e2) { - return (e1->hash.expr || + return (!e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr)) && e1->hash.mod == e2->hash.mod && e1->hash.seed_set == e2->hash.seed_set && |