diff options
author | Florian Westphal <fw@strlen.de> | 2012-11-19 22:39:55 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2012-11-28 22:00:06 +0100 |
commit | 525aa06da786f66709db4e1ec17bd635b8c5025a (patch) | |
tree | 1d546819294eaed4368c14b2deb55a214e6c3fa0 /qa/test_api.c | |
parent | 4984b297a3fa6f79ab9162617b9c90aca76d6f70 (diff) |
conntrack: fix nfct_clone with certain attribute data types
some attributes are pointers to malloc'd objects. Simply copying the
pointer results in use-after free when the original or the clone is
destroyed.
Fix it by using nfct_copy instead of memcpy and add proper test case
for cloned objects:
- nfct_cmp of orig and clone should return 1 (equal)
- freeing both the original and the clone should
neither leak memory nor result in double-frees.
the testsuite changes revealed a few more problems:
- ct1->timeout == ct2->timeout returned 0, ie. same timeout
was considered "not equal" by nfct_cmp
- secctx comparision causes "Invalid address" valgrind warnings
when pointer is NULL
- NFCT_CP_OVERRIDE did not handle helper attribute and
erronously freed ct1 secctx memory.
While at it, bump qa_test data dummy to 256 (else, valgrind
complains about move-depends-on-uninitialized-memory).
Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'qa/test_api.c')
-rw-r--r-- | qa/test_api.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/qa/test_api.c b/qa/test_api.c index e44c228..cdd128a 100644 --- a/qa/test_api.c +++ b/qa/test_api.c @@ -2,6 +2,7 @@ * Run this after adding a new attribute to the nf_conntrack object */ +#include <assert.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> @@ -35,7 +36,7 @@ int main(void) int ret, i; struct nf_conntrack *ct, *ct2, *tmp; struct nf_expect *exp, *tmp_exp; - char data[32]; + char data[256]; const char *val; int status; @@ -93,7 +94,6 @@ int main(void) case ATTR_SECCTX: case ATTR_TIMESTAMP_START: case ATTR_TIMESTAMP_STOP: - case ATTR_CONNLABELS: continue; /* These attributes require special handling */ case ATTR_HELPER_INFO: @@ -206,6 +206,11 @@ int main(void) eval_sigterm(status); } + ct2 = nfct_clone(ct); + assert(ct2); + assert(nfct_cmp(ct, ct2, NFCT_CMP_ALL) == 1); + nfct_destroy(ct2); + ct2 = nfct_new(); if (!ct2) { perror("nfct_new"); @@ -271,6 +276,7 @@ int main(void) } nfct_destroy(ct2); + printf("== destroy cloned ct entry ==\n"); nfct_destroy(ct); nfct_destroy(tmp); nfexp_destroy(exp); |