diff options
author | Florian Westphal <fw@strlen.de> | 2023-12-04 22:00:06 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2023-12-05 12:43:21 +0100 |
commit | 5f43ea807bb0f5b30f332c2c96f13e33c9243d22 (patch) | |
tree | 546663ac8df511db0919ddab83321a22cccc8024 | |
parent | d99b44adc5cfc455fdafd9b4bdabd413edf9a38a (diff) |
evaluate: reject attempt to update a set
This will crash as set->data is NULL, so check that SET_REF is pointing
to a map:
Error: candidates_ipv4 is not a map
tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10 :0004 timeout 1s }
~~~~~~~~~~~~~~~~
Signed-off-by: Florian Westphal <fw@strlen.de>
-rw-r--r-- | src/evaluate.c | 4 | ||||
-rw-r--r-- | tests/shell/testcases/bogons/nft-f/add_to_a_set_crash | 11 |
2 files changed, 15 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 131b0a0e..f05cac41 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -4344,6 +4344,10 @@ static int stmt_evaluate_map(struct eval_ctx *ctx, struct stmt *stmt) return expr_error(ctx->msgs, stmt->map.set, "Expression does not refer to a set"); + if (!set_is_map(stmt->map.set->set->flags)) + return expr_error(ctx->msgs, stmt->map.set, + "%s is not a map", stmt->map.set->set->handle.set.name); + if (stmt_evaluate_key(ctx, stmt, stmt->map.set->set->key->dtype, stmt->map.set->set->key->len, diff --git a/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash b/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash new file mode 100644 index 00000000..80a01b45 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash @@ -0,0 +1,11 @@ +table t { + set candidates_ipv4 { + type ipv4_addr . inet_service + size 65535 + flags dynamic,timeout + } + + chain input { + tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10 :0004 timeout 1s } + } +} |