diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-04-25 11:48:52 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-04-25 16:53:22 +0200 |
commit | 89b60bc18ca76e45b1682d8c56a0d01fffedebad (patch) | |
tree | adb11ee9284ffccdfdcbee09a5bc96ef60f800af /src | |
parent | bd976ab13b4d57ebf5d02459c360905a76af9e58 (diff) |
mnl: handle singleton element in netdevice set
expr_evaluate_set() turns sets with singleton element into value,
nft_dev_add() expects a list of expression, so it crashes.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1676
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
-rw-r--r-- | src/mnl.c | 46 |
1 files changed, 32 insertions, 14 deletions
@@ -720,31 +720,49 @@ err: */ struct nft_dev { - const char *ifname; - struct location *location; + const char *ifname; + const struct location *location; }; -static struct nft_dev *nft_dev_array(const struct expr *dev_expr, int *num_devs) +static void nft_dev_add(struct nft_dev *dev_array, const struct expr *expr, int i) { - struct nft_dev *dev_array; unsigned int ifname_len; char ifname[IFNAMSIZ]; + + ifname_len = div_round_up(expr->len, BITS_PER_BYTE); + memset(ifname, 0, sizeof(ifname)); + mpz_export_data(ifname, expr->value, BYTEORDER_HOST_ENDIAN, ifname_len); + dev_array[i].ifname = xstrdup(ifname); + dev_array[i].location = &expr->location; +} + +static struct nft_dev *nft_dev_array(const struct expr *dev_expr, int *num_devs) +{ + struct nft_dev *dev_array; int i = 0, len = 1; struct expr *expr; - list_for_each_entry(expr, &dev_expr->expressions, list) - len++; + switch (dev_expr->etype) { + case EXPR_SET: + case EXPR_LIST: + list_for_each_entry(expr, &dev_expr->expressions, list) + len++; - dev_array = xmalloc(sizeof(struct nft_dev) * len); + dev_array = xmalloc(sizeof(struct nft_dev) * len); - list_for_each_entry(expr, &dev_expr->expressions, list) { - ifname_len = div_round_up(expr->len, BITS_PER_BYTE); - memset(ifname, 0, sizeof(ifname)); - mpz_export_data(ifname, expr->value, BYTEORDER_HOST_ENDIAN, - ifname_len); - dev_array[i].ifname = xstrdup(ifname); - dev_array[i].location = &expr->location; + list_for_each_entry(expr, &dev_expr->expressions, list) { + nft_dev_add(dev_array, expr, i); + i++; + } + break; + case EXPR_VALUE: + len++; + dev_array = xmalloc(sizeof(struct nft_dev) * len); + nft_dev_add(dev_array, dev_expr, i); i++; + break; + default: + assert(0); } dev_array[i].ifname = NULL; |