From 78f542fc2a35fb099871cfb8eb73baa9a292033d Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 10 Jun 2019 17:26:41 +0200 Subject: netlink_delinearize: release expression before calling netlink_parse_concat_expr() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit netlink_get_register() clones the expression in the register. Release this expression before calling netlink_parse_concat_expr() to deconstruct the concatenation. ==15069== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==15069== by 0x4E79508: xmalloc (utils.c:36) ==15069== by 0x4E795ED: xzalloc (utils.c:65) ==15069== by 0x4E6029B: dtype_alloc (datatype.c:1073) ==15069== by 0x4E6029B: concat_type_alloc (datatype.c:1127) ==15069== by 0x4E6D3B3: netlink_delinearize_set (netlink.c:578) ==15069== by 0x4E6D68E: list_set_cb (netlink.c:648) ==15069== by 0x5F34023: nftnl_set_list_foreach (set.c:780) ==15069== by 0x4E6D6F3: netlink_list_sets (netlink.c:669) ==15069== by 0x4E5A7A3: cache_init_objects (rule.c:159) ==15069== by 0x4E5A7A3: cache_init (rule.c:216) ==15069== by 0x4E5A7A3: cache_update (rule.c:266) ==15069== by 0x4E7E09E: nft_evaluate (libnftables.c:388) ==15069== by 0x4E7E85B: nft_run_cmd_from_buffer (libnftables.c:428) Reported-by: Václav Zindulka Signed-off-by: Pablo Neira Ayuso --- src/netlink_delinearize.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src') diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index a1c775e6..0270e1fd 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -293,6 +293,7 @@ static void netlink_parse_cmp(struct netlink_parse_ctx *ctx, expr_basetype(left) != &string_type) { return netlink_error(ctx, loc, "Relational expression size mismatch"); } else if (left->len > 0 && left->len < right->len) { + expr_free(left); left = netlink_parse_concat_expr(ctx, loc, sreg, right->len); if (left == NULL) return; @@ -329,6 +330,7 @@ static void netlink_parse_lookup(struct netlink_parse_ctx *ctx, "Lookup expression has no left hand side"); if (left->len < set->key->len) { + expr_free(left); left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len); if (left == NULL) return; @@ -1317,6 +1319,7 @@ static void netlink_parse_dynset(struct netlink_parse_ctx *ctx, "Dynset statement has no key expression"); if (expr->len < set->key->len) { + expr_free(expr); expr = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len); if (expr == NULL) return; @@ -1408,6 +1411,7 @@ static void netlink_parse_objref(struct netlink_parse_ctx *ctx, "objref expression has no left hand side"); if (left->len < set->key->len) { + expr_free(left); left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len); if (left == NULL) return; -- cgit v1.2.3