From 89b60bc18ca76e45b1682d8c56a0d01fffedebad Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 25 Apr 2023 11:48:52 +0200 Subject: mnl: handle singleton element in netdevice set expr_evaluate_set() turns sets with singleton element into value, nft_dev_add() expects a list of expression, so it crashes. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1676 Signed-off-by: Pablo Neira Ayuso --- src/mnl.c | 46 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 14 deletions(-) (limited to 'src/mnl.c') diff --git a/src/mnl.c b/src/mnl.c index c590c955..5dcfd9a0 100644 --- a/src/mnl.c +++ b/src/mnl.c @@ -720,31 +720,49 @@ err: */ struct nft_dev { - const char *ifname; - struct location *location; + const char *ifname; + const struct location *location; }; -static struct nft_dev *nft_dev_array(const struct expr *dev_expr, int *num_devs) +static void nft_dev_add(struct nft_dev *dev_array, const struct expr *expr, int i) { - struct nft_dev *dev_array; unsigned int ifname_len; char ifname[IFNAMSIZ]; + + ifname_len = div_round_up(expr->len, BITS_PER_BYTE); + memset(ifname, 0, sizeof(ifname)); + mpz_export_data(ifname, expr->value, BYTEORDER_HOST_ENDIAN, ifname_len); + dev_array[i].ifname = xstrdup(ifname); + dev_array[i].location = &expr->location; +} + +static struct nft_dev *nft_dev_array(const struct expr *dev_expr, int *num_devs) +{ + struct nft_dev *dev_array; int i = 0, len = 1; struct expr *expr; - list_for_each_entry(expr, &dev_expr->expressions, list) - len++; + switch (dev_expr->etype) { + case EXPR_SET: + case EXPR_LIST: + list_for_each_entry(expr, &dev_expr->expressions, list) + len++; - dev_array = xmalloc(sizeof(struct nft_dev) * len); + dev_array = xmalloc(sizeof(struct nft_dev) * len); - list_for_each_entry(expr, &dev_expr->expressions, list) { - ifname_len = div_round_up(expr->len, BITS_PER_BYTE); - memset(ifname, 0, sizeof(ifname)); - mpz_export_data(ifname, expr->value, BYTEORDER_HOST_ENDIAN, - ifname_len); - dev_array[i].ifname = xstrdup(ifname); - dev_array[i].location = &expr->location; + list_for_each_entry(expr, &dev_expr->expressions, list) { + nft_dev_add(dev_array, expr, i); + i++; + } + break; + case EXPR_VALUE: + len++; + dev_array = xmalloc(sizeof(struct nft_dev) * len); + nft_dev_add(dev_array, dev_expr, i); i++; + break; + default: + assert(0); } dev_array[i].ifname = NULL; -- cgit v1.2.3