netlink_delinearize: use-after-free in expr_postprocess_string()

escaped_string_wildcard_expr_alloc() may reallocate the expression.
valgrind reports errors like this one:

==29945== Invalid write of size 4
==29945==    at 0x72EE944: __expr_postprocess_string (netlink_delinearize.c:2006)
==29945==    by 0x72EE944: expr_postprocess_string (netlink_delinearize.c:2016)
==29945==    by 0x72EE944: expr_postprocess (netlink_delinearize.c:2120)
==29945==    by 0x72EE5A7: expr_postprocess (netlink_delinearize.c:2094)
==29945==    by 0x72EF23B: stmt_expr_postprocess (netlink_delinearize.c:2289)
==29945==    by 0x72EF23B: rule_parse_postprocess (netlink_delinearize.c:2510)
==29945==    by 0x72EF23B: netlink_delinearize_rule (netlink_delinearize.c:2650)
==29945==    by 0x72E6F63: list_rule_cb (netlink.c:330)
==29945==    by 0x7770BD3: nftnl_rule_list_foreach (rule.c:810)
==29945==    by 0x72E739E: netlink_list_rules (netlink.c:349)
==29945==    by 0x72E739E: netlink_list_table (netlink.c:490)
==29945==    by 0x72D4A89: cache_init_objects (rule.c:194)
==29945==    by 0x72D4A89: cache_init (rule.c:216)
==29945==    by 0x72D4A89: cache_update (rule.c:266)
==29945==    by 0x72F829E: nft_evaluate (libnftables.c:388)
==29945==    by 0x72F8A5B: nft_run_cmd_from_buffer (libnftables.c:428)

Remove expr->len, not needed and it triggers use-after-free errors.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

0 files changed, 0 insertions, 0 deletions