Re: [nft PATCH] erec: Sanitize erec location indesc

[Phil Sutter <phil@nwl.cc>]

Hi Pablo,

On Wed, Feb 03, 2021 at 01:38:32AM +0100, Pablo Neira Ayuso wrote:
> On Tue, Jan 26, 2021 at 06:55:02PM +0100, Phil Sutter wrote:
> > erec_print() unconditionally dereferences erec->locations->indesc, so
> > make sure it is valid when either creating an erec or adding a location.
> 
> I guess your're trigger a bug where erec is indesc is NULL, thing is
> that indesc should be always set on. Is there a reproducer for this bug?

Yes, exactly. I hit it when trying to clean up the netdev family reject
support, while just "hacking around". You can trigger it with the
following change:

| --- a/src/evaluate.c
| +++ b/src/evaluate.c
| @@ -2718,7 +2718,7 @@ static int stmt_evaluate_reject_bridge(struct eval_ctx *ctx, struct stmt *stmt,
|         const struct proto_desc *desc;
|  
|         desc = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
| -       if (desc != &proto_eth && desc != &proto_vlan && desc != &proto_netdev)
| +       if (desc != &proto_eth && desc != &proto_vlan)
|                 return stmt_binary_error(ctx,
|                                          &ctx->pctx.protocol[PROTO_BASE_LL_HDR],
|                                          stmt, "unsupported link layer protocol");

and this ruleset:

| table netdev t {
| 	chain c {
| 		reject
| 	}
| }

Cheers, Phil