diff options
| author | Florian Westphal <fw@strlen.de> | 2023-12-05 12:56:08 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-12-06 16:52:29 +0100 |
| commit | 59a33d08ab3a75b2ae370b6816942793f49fa8db (patch) | |
| tree | 2745890e21596df8783a8b7b3b14ef725a57ce31 /src/parser_bison.y | |
| parent | 77ba01907cb46a504ef0c0c9705308fd2883cbb4 (diff) | |
parser: tcpopt: fix tcp option parsing with NUM + length field
tcp option 254 length ge 4
... will segfault.
The crash bug is that tcpopt_expr_alloc() can return NULL if we cannot
find a suitable template for the requested kind + field combination,
so add the needed error handling in the bison parser.
However, we can handle this. NOP and EOL have templates, all other
options (known or unknown) must also have a length field.
So also add a fallback template to handle both kind and length, even
if only a numeric option is given that nft doesn't recognize.
Don't bother with output, above will be printed via raw syntax, i.e.
tcp option @254,8,8 >= 4.
Fixes: 24d8da308342 ("tcpopt: allow to check for presence of any tcp option")
Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/parser_bison.y')
| -rw-r--r-- | src/parser_bison.y | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/parser_bison.y b/src/parser_bison.y index ee7e9e14..1a3d64f7 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -5828,6 +5828,10 @@ tcp_hdr_expr : TCP tcp_hdr_field | TCP OPTION tcp_hdr_option_kind_and_field { $$ = tcpopt_expr_alloc(&@$, $3.kind, $3.field); + if ($$ == NULL) { + erec_queue(error(&@1, "Could not find a tcp option template"), state->msgs); + YYERROR; + } } | TCP OPTION AT close_scope_at tcp_hdr_option_type COMMA NUM COMMA NUM { |