From 59a33d08ab3a75b2ae370b6816942793f49fa8db Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 5 Dec 2023 12:56:08 +0100 Subject: parser: tcpopt: fix tcp option parsing with NUM + length field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tcp option 254 length ge 4 ... will segfault. The crash bug is that tcpopt_expr_alloc() can return NULL if we cannot find a suitable template for the requested kind + field combination, so add the needed error handling in the bison parser. However, we can handle this. NOP and EOL have templates, all other options (known or unknown) must also have a length field. So also add a fallback template to handle both kind and length, even if only a numeric option is given that nft doesn't recognize. Don't bother with output, above will be printed via raw syntax, i.e. tcp option @254,8,8 >= 4. Fixes: 24d8da308342 ("tcpopt: allow to check for presence of any tcp option") Reported-by: Maciej Żenczykowski Signed-off-by: Florian Westphal --- tests/shell/testcases/packetpath/dumps/tcp_options.nodump | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 tests/shell/testcases/packetpath/dumps/tcp_options.nodump (limited to 'tests/shell/testcases/packetpath/dumps/tcp_options.nodump') diff --git a/tests/shell/testcases/packetpath/dumps/tcp_options.nodump b/tests/shell/testcases/packetpath/dumps/tcp_options.nodump new file mode 100644 index 00000000..e69de29b -- cgit v1.2.3