diff options
| author | Phil Sutter <phil@nwl.cc> | 2018-08-06 17:23:23 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2018-08-06 18:17:39 +0200 |
| commit | a9d9f64b7c06c17c98c175f1c44e8979ba0e14c3 (patch) | |
| tree | 55f3634d2a7bab5b0f90786fdfccb423758e5d0f /iptables | |
| parent | fbf0bf7c079d8094accd57643b7eccc6b96423f2 (diff) | |
xtables: Fix potential segfault in nft_rule_append()
If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the
rule and then tries to add it to the rule cache. Better return 0
(failure) instead of continuing.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'iptables')
| -rw-r--r-- | iptables/nft.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index b893859d..1c076510 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1173,8 +1173,10 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table, } else type = NFT_COMPAT_RULE_APPEND; - if (batch_rule_add(h, type, r) < 0) + if (batch_rule_add(h, type, r) < 0) { nftnl_rule_free(r); + return 0; + } if (verbose) h->ops->print_rule(r, 0, FMT_PRINT_RULE); |