diff options
author | Florian Westphal <fw@strlen.de> | 2012-11-19 22:39:55 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2012-11-28 22:00:06 +0100 |
commit | 525aa06da786f66709db4e1ec17bd635b8c5025a (patch) | |
tree | 1d546819294eaed4368c14b2deb55a214e6c3fa0 /src/conntrack/compare.c | |
parent | 4984b297a3fa6f79ab9162617b9c90aca76d6f70 (diff) |
conntrack: fix nfct_clone with certain attribute data types
some attributes are pointers to malloc'd objects. Simply copying the
pointer results in use-after free when the original or the clone is
destroyed.
Fix it by using nfct_copy instead of memcpy and add proper test case
for cloned objects:
- nfct_cmp of orig and clone should return 1 (equal)
- freeing both the original and the clone should
neither leak memory nor result in double-frees.
the testsuite changes revealed a few more problems:
- ct1->timeout == ct2->timeout returned 0, ie. same timeout
was considered "not equal" by nfct_cmp
- secctx comparision causes "Invalid address" valgrind warnings
when pointer is NULL
- NFCT_CP_OVERRIDE did not handle helper attribute and
erronously freed ct1 secctx memory.
While at it, bump qa_test data dummy to 256 (else, valgrind
complains about move-depends-on-uninitialized-memory).
Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/conntrack/compare.c')
-rw-r--r-- | src/conntrack/compare.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c index 830195f..b18f7fc 100644 --- a/src/conntrack/compare.c +++ b/src/conntrack/compare.c @@ -300,8 +300,8 @@ cmp_timeout(const struct nf_conntrack *ct1, #define __NFCT_CMP_TIMEOUT (NFCT_CMP_TIMEOUT_LE | NFCT_CMP_TIMEOUT_GT) if (!(flags & __NFCT_CMP_TIMEOUT) && - ct1->timeout != ct2->timeout) - return 0; + ct1->timeout == ct2->timeout) + return 1; else { if (flags & NFCT_CMP_TIMEOUT_GT && ct1->timeout > ct2->timeout) @@ -312,9 +312,6 @@ cmp_timeout(const struct nf_conntrack *ct1, else if (flags & NFCT_CMP_TIMEOUT_EQ && ct1->timeout == ct2->timeout) ret = 1; - - if (ret == 0) - return 0; } return ret; } @@ -364,6 +361,8 @@ cmp_secctx(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags) { + if (ct1->secctx == NULL || ct1->secctx == NULL) + return ct1->secctx == ct2->secctx; return strcmp(ct1->secctx, ct2->secctx) == 0; } |