From ee73e9dcd46dc5a1fe3be7caa8b9323819e394b8 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 5 Dec 2023 13:08:17 +0100 Subject: evaluate: fix double free on dtype release We release ->dtype twice, will either segfault or assert on dtype->refcount != 0 check in datatype_free(). Signed-off-by: Florian Westphal --- .../shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert (limited to 'tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert') diff --git a/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert new file mode 100644 index 00000000..b7a9a1cc --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert @@ -0,0 +1,6 @@ +table inet t { + chain c { + udp length . @th,160,118 vmap { 47-63 . 0xe3731353631303331313037353532/3 : accept } + jump noexist # only here so this fails to load after patch. + } +} -- cgit v1.2.3