path: root/src/ruleset.c
diff options
authorAlvaro Neira <>2015-02-24 09:10:32 +0100
committerPablo Neira Ayuso <>2015-02-24 14:47:23 +0100
commit5dd19ef301a9c92beb470099df0a76e33a614173 (patch)
tree5aa0f9eee91141be1a2ec1e98c883c7948bd9d59 /src/ruleset.c
parent05eb2b89defda80be57199315f6bf40cf711460e (diff)
ruleset: fix crash if we free sets included in the set_list
When we parse a ruleset which has a rule using a set. First step is to parse the set, set up an ID and add it to a set list. Later, we use this set list to find the set associated to the rule and we set up the set ID to the expression (lookup expression) of the rule. The problem is that if we return this set to the callback function nft_ruleset_parse_file_cb() and we free this set, we have a crash when we try to iterate in the set list. This patch solves it, cloning the set and adding the new set to the set list. Signed-off-by: Alvaro Neira Ayuso <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'src/ruleset.c')
1 files changed, 8 insertions, 1 deletions
diff --git a/src/ruleset.c b/src/ruleset.c
index 89ea344..280f1bc 100644
--- a/src/ruleset.c
+++ b/src/ruleset.c
@@ -312,8 +312,15 @@ static int nft_ruleset_parse_set(struct nft_parse_ctx *ctx,
struct nft_set *set, uint32_t type,
struct nft_parse_err *err)
+ struct nft_set *newset;
nft_set_attr_set_u32(set, NFT_SET_ATTR_ID, ctx->set_id++);
- nft_set_list_add_tail(set, ctx->set_list);
+ newset = nft_set_clone(set);
+ if (newset == NULL)
+ goto err;
+ nft_set_list_add_tail(newset, ctx->set_list);
nft_ruleset_ctx_set_u32(ctx, NFT_RULESET_CTX_TYPE, type);
nft_ruleset_ctx_set(ctx, NFT_RULESET_CTX_SET, set);