Re: [nft PATCH] erec: Sanitize erec location indesc

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Phil,

On Tue, Jan 26, 2021 at 06:55:02PM +0100, Phil Sutter wrote:
> erec_print() unconditionally dereferences erec->locations->indesc, so
> make sure it is valid when either creating an erec or adding a location.

I guess your're trigger a bug where erec is indesc is NULL, thing is
that indesc should be always set on. Is there a reproducer for this bug?

> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
>  src/erec.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/src/erec.c b/src/erec.c
> index c550a596b38c8..5c3351a512464 100644
> --- a/src/erec.c
> +++ b/src/erec.c
> @@ -38,7 +38,8 @@ void erec_add_location(struct error_record *erec, const struct location *loc)
>  {
>  	assert(erec->num_locations < EREC_LOCATIONS_MAX);
>  	erec->locations[erec->num_locations] = *loc;
> -	erec->locations[erec->num_locations].indesc = loc->indesc;
> +	erec->locations[erec->num_locations].indesc = loc->indesc ?
> +						    : &internal_indesc;
>  	erec->num_locations++;
>  }
>  
> -- 
> 2.28.0
>