From dc6a6e83b47fc7078a061350cd2b111cb2adec14 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 26 Feb 2019 22:13:39 +0100 Subject: parser_json: Duplicate chain name when parsing jump verdict Since verdict expression frees the chain name, pass a newly allocated string to it. Otherwise double free happens because json_decref() frees the string property value as well. Fixes: d1057a5feb5fd ("JSON: Simplify verdict statement parsing") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- src/parser_json.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/parser_json.c b/src/parser_json.c index d00cf422..78214f65 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -1075,7 +1075,8 @@ static struct expr *json_parse_verdict_expr(struct json_ctx *ctx, return NULL; return verdict_expr_alloc(int_loc, - verdict_tbl[i].verdict, chain); + verdict_tbl[i].verdict, + chain ? xstrdup(chain) : NULL); } json_error(ctx, "Unknown verdict '%s'.", type); return NULL; -- cgit v1.2.3