diff options
| author | Florian Westphal <fw@strlen.de> | 2023-12-05 13:08:17 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-12-05 20:30:38 +0100 |
| commit | ee73e9dcd46dc5a1fe3be7caa8b9323819e394b8 (patch) | |
| tree | 87ac14962db6ad3f57bb1555503e30613e7822a3 /tests/shell | |
| parent | 70054e6e1c879475779d82d19f450ac521700fe4 (diff) | |
evaluate: fix double free on dtype release
We release ->dtype twice, will either segfault or assert
on dtype->refcount != 0 check in datatype_free().
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'tests/shell')
| -rw-r--r-- | tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert new file mode 100644 index 00000000..b7a9a1cc --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/double-free-on-binop-dtype_assert @@ -0,0 +1,6 @@ +table inet t { + chain c { + udp length . @th,160,118 vmap { 47-63 . 0xe3731353631303331313037353532/3 : accept } + jump noexist # only here so this fails to load after patch. + } +} |