diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-02-25 13:15:14 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-02-25 13:40:34 +0100 |
| commit | 1db6c61f233a0488bc4c9b8fc47d205d4885ef50 (patch) | |
| tree | 5f200eb44710d1a4d0b7ff789a9e15e1bc3717a1 | |
| parent | 51a09ac313cccff1dd65f546d218e9a6fa2a668f (diff) | |
datatype: add DTYPE_F_CLONE flag
This flag allows us to identify datatypes that are instances from
original datatypes.
This fixes a possible double free when attaching a concatenation
datatype to set->keytype while being also referenced from concatenation
expressions.
ip6/flowtable.t: ERROR: line 5: src/nft add rule --debug=netlink ip6 test-ip6 input flow table acct_out { meta iif . ip6 saddr timeout 600s counter }: This rule should not have failed.
*** Error in `src/nft': double free or corruption (fasttop): 0x000000000117ce70 ***
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | include/datatype.h | 2 | ||||
| -rw-r--r-- | src/datatype.c | 5 |
2 files changed, 5 insertions, 2 deletions
diff --git a/include/datatype.h b/include/datatype.h index 68fb2a6c..3ce3a888 100644 --- a/include/datatype.h +++ b/include/datatype.h @@ -109,10 +109,12 @@ struct expr; * * @DTYPE_F_ALLOC: datatype is dynamically allocated * @DTYPE_F_PREFIX: preferred representation for ranges is a prefix + * @DTYPE_F_CLONE: this is an instance from original datatype */ enum datatype_flags { DTYPE_F_ALLOC = (1 << 0), DTYPE_F_PREFIX = (1 << 1), + DTYPE_F_CLONE = (1 << 2), }; /** diff --git a/src/datatype.c b/src/datatype.c index bfc8817c..64b8b884 100644 --- a/src/datatype.c +++ b/src/datatype.c @@ -973,7 +973,7 @@ static struct datatype *dtype_clone(const struct datatype *orig_dtype) *dtype = *orig_dtype; dtype->name = xstrdup(orig_dtype->name); dtype->desc = xstrdup(orig_dtype->desc); - dtype->flags = DTYPE_F_ALLOC; + dtype->flags = DTYPE_F_ALLOC | DTYPE_F_CLONE; return dtype; } @@ -1046,7 +1046,8 @@ const struct datatype *set_keytype_alloc(const struct datatype *orig_dtype, void set_keytype_destroy(const struct datatype *dtype) { - dtype_free(dtype); + if (dtype->flags & DTYPE_F_CLONE) + dtype_free(dtype); } static struct error_record *time_unit_parse(const struct location *loc, |