From 10e19428a5ef9568d9d1ba88f9158eaa0a161cb3 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 15 Mar 2019 11:31:50 +0100 Subject: src: file descriptor leak in include_file() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit File that contains the ruleset is never closed, track open files through the nft_ctx object and close them accordingly. Reported-by: Václav Zindulka Signed-off-by: Pablo Neira Ayuso --- include/nftables.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include/nftables.h') diff --git a/include/nftables.h b/include/nftables.h index 5c029261..b17a16a4 100644 --- a/include/nftables.h +++ b/include/nftables.h @@ -86,6 +86,8 @@ struct nft_cache { struct mnl_socket; struct parser_state; +#define MAX_INCLUDE_DEPTH 16 + struct nft_ctx { struct mnl_socket *nf_sock; char **include_paths; @@ -99,6 +101,7 @@ struct nft_ctx { struct parser_state *state; void *scanner; void *json_root; + FILE *f[MAX_INCLUDE_DEPTH]; }; enum nftables_exit_codes { -- cgit v1.2.3