From 02174ffad484d9711678e5d415c32307efc39857 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 9 Jan 2020 17:43:11 +0100 Subject: monitor: Fix for use after free when printing map elements When populating the dummy set, 'data' field must be cloned just like 'key' field. Fixes: 343a51702656a ("src: store expr, not dtype to track data in sets") Signed-off-by: Phil Sutter Acked-by: Pablo Neira Ayuso --- src/monitor.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/monitor.c') diff --git a/src/monitor.c b/src/monitor.c index 84505eb9..53a8bcd4 100644 --- a/src/monitor.c +++ b/src/monitor.c @@ -401,7 +401,8 @@ static int netlink_events_setelem_cb(const struct nlmsghdr *nlh, int type, */ dummyset = set_alloc(monh->loc); dummyset->key = expr_clone(set->key); - dummyset->data = set->data; + if (set->data) + dummyset->data = expr_clone(set->data); dummyset->flags = set->flags; dummyset->init = set_expr_alloc(monh->loc, set); -- cgit v1.2.3