From c6cd7c22548a545ea9a831a1ea725d1716295b4a Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Sat, 11 Mar 2017 12:20:11 +0800 Subject: src: fix crash when inputting an incomplete set add command After inputting the following nft command, set->keytype is not initialized but we try to destroy it, so NULL pointer dereference will happen: # nft add set t s Segmentation fault (core dumped) #0 dtype_free (dtype=0x0) at datatype.c:1049 #1 set_datatype_destroy (dtype=0x0) at datatype.c:1051 #2 0x0000000000407f1a in set_free (set=0x838790) at rule.c:213 #3 0x000000000042ff70 in nft_parse (scanner=scanner@entry=0x8386a0, state=state@entry=0x7ffc313ea670) at parser_bison.c:9355 #4 0x000000000040727d in nft_run (scanner=scanner@entry=0x8386a0, state=state@entry=0x7ffc313ea670, msgs=msgs@entry=0x7ffc313ea660) at main.c:237 #5 0x0000000000406e4a in main (argc=, argv=) at main.c:376 Fixes: b9b6092304ae ("evaluate: store byteorder for set keys") Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso --- src/datatype.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/datatype.c') diff --git a/src/datatype.c b/src/datatype.c index c61c4245..06a045bc 100644 --- a/src/datatype.c +++ b/src/datatype.c @@ -1047,7 +1047,7 @@ const struct datatype *set_datatype_alloc(const struct datatype *orig_dtype, void set_datatype_destroy(const struct datatype *dtype) { - if (dtype->flags & DTYPE_F_CLONE) + if (dtype && dtype->flags & DTYPE_F_CLONE) dtype_free(dtype); } -- cgit v1.2.3