diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-06-13 11:26:36 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-06-13 12:22:42 +0200 |
| commit | 8358ee1bf3236f0d2b1ccfdcf7d31cd7063815a5 (patch) | |
| tree | 4f5ae6d0fd8fa065e54aafc9c53c0522167c2c58 /src/netlink_delinearize.c | |
| parent | 388361e75b00582898c75cb8b90e8a3a7c887990 (diff) | |
netlink_delinearize: use-after-free in expr_postprocess_string()
escaped_string_wildcard_expr_alloc() may reallocate the expression.
valgrind reports errors like this one:
==29945== Invalid write of size 4
==29945== at 0x72EE944: __expr_postprocess_string (netlink_delinearize.c:2006)
==29945== by 0x72EE944: expr_postprocess_string (netlink_delinearize.c:2016)
==29945== by 0x72EE944: expr_postprocess (netlink_delinearize.c:2120)
==29945== by 0x72EE5A7: expr_postprocess (netlink_delinearize.c:2094)
==29945== by 0x72EF23B: stmt_expr_postprocess (netlink_delinearize.c:2289)
==29945== by 0x72EF23B: rule_parse_postprocess (netlink_delinearize.c:2510)
==29945== by 0x72EF23B: netlink_delinearize_rule (netlink_delinearize.c:2650)
==29945== by 0x72E6F63: list_rule_cb (netlink.c:330)
==29945== by 0x7770BD3: nftnl_rule_list_foreach (rule.c:810)
==29945== by 0x72E739E: netlink_list_rules (netlink.c:349)
==29945== by 0x72E739E: netlink_list_table (netlink.c:490)
==29945== by 0x72D4A89: cache_init_objects (rule.c:194)
==29945== by 0x72D4A89: cache_init (rule.c:216)
==29945== by 0x72D4A89: cache_update (rule.c:266)
==29945== by 0x72F829E: nft_evaluate (libnftables.c:388)
==29945== by 0x72F8A5B: nft_run_cmd_from_buffer (libnftables.c:428)
Remove expr->len, not needed and it triggers use-after-free errors.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_delinearize.c')
| -rw-r--r-- | src/netlink_delinearize.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 6576687c..1f63d9d5 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -2003,7 +2003,6 @@ static bool __expr_postprocess_string(struct expr **exprp) escaped_string_wildcard_expr_alloc(exprp, len); mpz_clear(tmp); - expr->len = len; return nulterminated; } @@ -2119,6 +2118,7 @@ static void expr_postprocess(struct rule_pp_ctx *ctx, struct expr **exprp) if (expr_basetype(expr)->type == TYPE_STRING) *exprp = expr_postprocess_string(expr); + expr = *exprp; if (expr->dtype->basetype != NULL && expr->dtype->basetype->type == TYPE_BITMASK) *exprp = bitmask_expr_to_binops(expr); |