From 27107b4932b1bd1a39c21e0d7865f3bf220a3857 Mon Sep 17 00:00:00 2001 From: Peter Tirsek Date: Sun, 26 Jun 2022 00:47:07 -0500 Subject: evaluate: fix segfault when adding elements to invalid set Adding elements to a set or map with an invalid definition causes nft to segfault. The following nftables.conf triggers the crash: flush ruleset create table inet filter set inet filter foo {} add element inet filter foo { foobar } Simply parsing and checking the config will trigger it: $ nft -c -f nftables.conf.crash Segmentation fault The error in the set/map definition is correctly caught and queued, but because the set is invalid and does not contain a key type, adding to it causes a NULL pointer dereference of set->key within setelem_evaluate(). I don't think it's necessary to queue another error since the underlying problem is correctly detected and reported when parsing the definition of the set. Simply checking the validity of set->key before using it seems to fix it, causing the error in the definition of the set to be reported properly. The element type error isn't caught, but that seems reasonable since the key type is invalid or unknown anyway: $ ./nft -c -f ~/nftables.conf.crash /home/pti/nftables.conf.crash:3:21-21: Error: set definition does not specify key set inet filter foo {} ^ [ Add tests to cover this case --pablo ] Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1597 Signed-off-by: Peter Tirsek Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/sets/errors_0 | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'tests') diff --git a/tests/shell/testcases/sets/errors_0 b/tests/shell/testcases/sets/errors_0 index a676ac73..569f4ab8 100755 --- a/tests/shell/testcases/sets/errors_0 +++ b/tests/shell/testcases/sets/errors_0 @@ -27,4 +27,15 @@ delete element x y { 1.1.1.1/24 } add element x y { 1.1.1.1/24 } delete element x y { 2.2.2.2/24 }" +$NFT -f - <<< $RULESET +if [ $? -eq 0 ] +then + exit 1 +fi + +RULESET="flush ruleset +create table inet filter +set inet filter foo {} +add element inet filter foo { foobar }" + $NFT -f - <<< $RULESET || exit 0 -- cgit v1.2.3