From f7b0eef8391ae7f89a3a82f6eeecaebe199224d7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 11 Jun 2021 16:07:02 +0200 Subject: parser_json: Fix for memleak in tcp option error path If 'kind' value is invalid, the function returned without freeing 'expr' first. Fix this by performing the check before allocation. Fixes: cb21869649208 ("json: tcp: add raw tcp option match support") Signed-off-by: Phil Sutter --- src/parser_json.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/parser_json.c b/src/parser_json.c index e6a0233a..bb0e4169 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -603,12 +603,12 @@ static struct expr *json_parse_tcp_option_expr(struct json_ctx *ctx, "base", &kind, "offset", &offset, "len", &len)) { uint32_t flag = 0; - expr = tcpopt_expr_alloc(int_loc, kind, - TCPOPT_COMMON_KIND); - if (kind < 0 || kind > 255) return NULL; + expr = tcpopt_expr_alloc(int_loc, kind, + TCPOPT_COMMON_KIND); + if (offset == TCPOPT_COMMON_KIND && len == 8) flag = NFT_EXTHDR_F_PRESENT; -- cgit v1.2.3