From 6d225d296ec48adefdbd3d003598a5d3c4ee22ff Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Wed, 30 Jun 2021 17:45:18 +0200 Subject: netlink_delinarize: don't check for set element if set is not populated 0065_icmp_postprocessing: line 13: Segmentation fault $NFT insert rule ip x foo index 1 accept Since no listing is done, cache isn't populated and 'nft insert' will trip over set->init == NULL during postprocessing of the existing 'icmp id 42' expression. Fixes: 9a5574e2d4e9 ("netlink_delinearize: add missing icmp id/sequence support") Reported-by: Eric Garver Reported-by: Phil Sutter Signed-off-by: Florian Westphal --- src/netlink_delinearize.c | 1 + 1 file changed, 1 insertion(+) (limited to 'src/netlink_delinearize.c') diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 6a6f7747..71b69f62 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -1945,6 +1945,7 @@ static void payload_match_postprocess(struct rule_pp_ctx *ctx, struct set *set = expr->right->set; if (set_is_anonymous(set->flags) && + set->init && !list_empty(&set->init->expressions)) { struct expr *elem; -- cgit v1.2.3