From 1db6c61f233a0488bc4c9b8fc47d205d4885ef50 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sat, 25 Feb 2017 13:15:14 +0100 Subject: datatype: add DTYPE_F_CLONE flag This flag allows us to identify datatypes that are instances from original datatypes. This fixes a possible double free when attaching a concatenation datatype to set->keytype while being also referenced from concatenation expressions. ip6/flowtable.t: ERROR: line 5: src/nft add rule --debug=netlink ip6 test-ip6 input flow table acct_out { meta iif . ip6 saddr timeout 600s counter }: This rule should not have failed. *** Error in `src/nft': double free or corruption (fasttop): 0x000000000117ce70 *** Signed-off-by: Pablo Neira Ayuso --- src/datatype.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/datatype.c b/src/datatype.c index bfc8817c..64b8b884 100644 --- a/src/datatype.c +++ b/src/datatype.c @@ -973,7 +973,7 @@ static struct datatype *dtype_clone(const struct datatype *orig_dtype) *dtype = *orig_dtype; dtype->name = xstrdup(orig_dtype->name); dtype->desc = xstrdup(orig_dtype->desc); - dtype->flags = DTYPE_F_ALLOC; + dtype->flags = DTYPE_F_ALLOC | DTYPE_F_CLONE; return dtype; } @@ -1046,7 +1046,8 @@ const struct datatype *set_keytype_alloc(const struct datatype *orig_dtype, void set_keytype_destroy(const struct datatype *dtype) { - dtype_free(dtype); + if (dtype->flags & DTYPE_F_CLONE) + dtype_free(dtype); } static struct error_record *time_unit_parse(const struct location *loc, -- cgit v1.2.3