From efd09355038d53fdd3841ab5ccae1543c4967daf Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 17 Jul 2015 14:38:37 +0200 Subject: netlink_delinearize: meta l4proto range printing broken on 32bit Florian Westphal says: 09565a4b1ed4863d44c4509a93c50f44efd12771 ("netlink_delinearize: consolidate range printing") causes nft to segfault on 32bit machine when printing l4proto ranges. The problem is that meta_expr_pctx_update() assumes that right is a value, but after this change it can also be a range. Thus, expr->value contents are undefined (its union). On x86_64 this is also broken but by virtue of struct layout and pointer sizes, value->_mp_size will almost always be 0 so mpz_get_uint8() returns 0. But on x86-32 _mp_size will be huge value (contains expr->right pointer of range), so we crash in libgmp. Pablo says: We shouldn't call pctx_update(), before the transformation we had there a expr->op == { OP_GT, OP_GTE, OP_LT, OP_LTE }. So we never entered that path as the assert in payload_expr_pctx_update() indicates. Signed-off-by: Pablo Neira Ayuso Tested-by: Florian Westphal --- src/netlink_delinearize.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 6d60be32..4226b822 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -983,6 +983,9 @@ static void meta_match_postprocess(struct rule_pp_ctx *ctx, switch (expr->op) { case OP_EQ: + if (expr->right->ops->type == EXPR_RANGE) + break; + expr->left->ops->pctx_update(&ctx->pctx, expr); if (ctx->pbase == PROTO_BASE_INVALID && -- cgit v1.2.3