diff options
| author | Florian Westphal <fw@strlen.de> | 2021-12-03 17:07:55 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2021-12-07 12:23:22 +0100 |
| commit | 48aca2de80a7dd73f8f3a461c7f7ed47b6082766 (patch) | |
| tree | 3ab36458bdef07e5d8c78ad364b77c21ffaad123 /src | |
| parent | 028856b3dd8c935bc53ff08434dce4728627a318 (diff) | |
iptopt: fix crash with invalid field/type combo
% nft describe ip option rr value
segmentation fault
after this fix, this exits with 'Error: unknown ip option type/field'.
Problem is that 'rr' doesn't have a value template, so the template struct is
all-zeroes, so we crash when trying to use tmpl->dtype (its NULL).
Furthermore, expr_describe tries to print expr->identifier but expr is
exthdr, not symbol: ->identifier contains garbage.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src')
| -rw-r--r-- | src/expression.c | 8 | ||||
| -rw-r--r-- | src/ipopt.c | 3 | ||||
| -rw-r--r-- | src/parser_bison.y | 4 |
3 files changed, 11 insertions, 4 deletions
diff --git a/src/expression.c b/src/expression.c index 4c0874fe..f1cca884 100644 --- a/src/expression.c +++ b/src/expression.c @@ -135,12 +135,12 @@ void expr_describe(const struct expr *expr, struct output_ctx *octx) nft_print(octx, "datatype %s (%s)", dtype->name, dtype->desc); len = dtype->size; - } else if (dtype != &invalid_type) { + } else { nft_print(octx, "%s expression, datatype %s (%s)", expr_name(expr), dtype->name, dtype->desc); - } else { - nft_print(octx, "datatype %s is invalid\n", expr->identifier); - return; + + if (dtype == &invalid_type) + return; } if (dtype->basetype != NULL) { diff --git a/src/ipopt.c b/src/ipopt.c index 42ea41cd..67e904ff 100644 --- a/src/ipopt.c +++ b/src/ipopt.c @@ -78,6 +78,9 @@ struct expr *ipopt_expr_alloc(const struct location *loc, uint8_t type, if (!tmpl) return NULL; + if (!tmpl->len) + return NULL; + expr = expr_alloc(loc, EXPR_EXTHDR, tmpl->dtype, BYTEORDER_BIG_ENDIAN, tmpl->len); expr->exthdr.desc = desc; diff --git a/src/parser_bison.y b/src/parser_bison.y index 357850de..16607bb7 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -5332,6 +5332,10 @@ ip_hdr_expr : IP ip_hdr_field close_scope_ip | IP OPTION ip_option_type ip_option_field close_scope_ip { $$ = ipopt_expr_alloc(&@$, $3, $4); + if (!$$) { + erec_queue(error(&@1, "unknown ip option type/field"), state->msgs); + YYERROR; + } } | IP OPTION ip_option_type close_scope_ip { |