Re: [nft PATCH 2/4] netlink_delinearize: Avoid potential null pointer deref

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Aug 12, 2016 at 06:00:08PM +0200, Phil Sutter wrote:
> As netlink_get_register() may return NULL, we must not pass the returned
> data unchecked to expr_set_type() as that will dereference it. Since the
> parser has failed at that point anyway, by returning early we can skip
> the useless statement allocation that follows in
> netlink_parse_ct_stmt().
> 
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
>  src/netlink_delinearize.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
> index 12d0b4a277795..6ac2e9690fd39 100644
> --- a/src/netlink_delinearize.c
> +++ b/src/netlink_delinearize.c
> @@ -518,6 +518,8 @@ static void netlink_parse_ct_stmt(struct netlink_parse_ctx *ctx,
>  
>  	sreg = netlink_parse_register(nle, NFTNL_EXPR_CT_SREG);
>  	expr = netlink_get_register(ctx, loc, sreg);
> +	if (!expr)
> +		return;

I would add a netlink_error() by here too.

I can see more spots with this problem, would you send us a patch to
resolve the multiple reincarnations of this problem in one go?

Thanks!