From 48aca2de80a7dd73f8f3a461c7f7ed47b6082766 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 3 Dec 2021 17:07:55 +0100 Subject: iptopt: fix crash with invalid field/type combo % nft describe ip option rr value segmentation fault after this fix, this exits with 'Error: unknown ip option type/field'. Problem is that 'rr' doesn't have a value template, so the template struct is all-zeroes, so we crash when trying to use tmpl->dtype (its NULL). Furthermore, expr_describe tries to print expr->identifier but expr is exthdr, not symbol: ->identifier contains garbage. Signed-off-by: Florian Westphal --- src/parser_bison.y | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index 357850de..16607bb7 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -5332,6 +5332,10 @@ ip_hdr_expr : IP ip_hdr_field close_scope_ip | IP OPTION ip_option_type ip_option_field close_scope_ip { $$ = ipopt_expr_alloc(&@$, $3, $4); + if (!$$) { + erec_queue(error(&@1, "unknown ip option type/field"), state->msgs); + YYERROR; + } } | IP OPTION ip_option_type close_scope_ip { -- cgit v1.2.3