[PATCH nft] evaluate: don't crash if range has same start and end interval

[Florian Westphal <fw@strlen.de>]

In this case, evaluation step replaces the range expression with a
single value and we'd crash as range->left/right contain garbage
values.

Simply replace the input expression with the evaluation result.

Also add a test case modeled on the afl reproducer.

Fixes: fe6cc0ad29cd ("evaluate: consolidate evaluation of symbol range expression")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/evaluate.c                                |  5 +++
 .../dumps/range_with_same_start_end.json-nft  | 35 +++++++++++++++++++
 .../sets/dumps/range_with_same_start_end.nft  |  7 ++++
 .../testcases/sets/range_with_same_start_end  | 13 +++++++
 4 files changed, 60 insertions(+)
 create mode 100644 tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
 create mode 100644 tests/shell/testcases/sets/dumps/range_with_same_start_end.nft
 create mode 100755 tests/shell/testcases/sets/range_with_same_start_end

diff --git a/src/evaluate.c b/src/evaluate.c
index e27d08ce7ef8..722c11a23c2d 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2351,6 +2351,10 @@ static int expr_evaluate_symbol_range(struct eval_ctx *ctx, struct expr **exprp)
 		expr_free(range);
 		return -1;
 	}
+
+	if (range->etype != EXPR_RANGE)
+		goto out_done;
+
 	left = range->left;
 	right = range->right;
 
@@ -2371,6 +2375,7 @@ static int expr_evaluate_symbol_range(struct eval_ctx *ctx, struct expr **exprp)
 		return 0;
 	}
 
+out_done:
 	expr_free(expr);
 	*exprp = range;
 
diff --git a/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft b/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
new file mode 100644
index 000000000000..c4682475917e
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
@@ -0,0 +1,35 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "set": {
+        "family": "ip",
+        "name": "X",
+        "table": "t",
+        "type": "inet_service",
+        "handle": 0,
+        "flags": [
+          "interval"
+        ],
+        "elem": [
+          10,
+          30,
+          35
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/shell/testcases/sets/dumps/range_with_same_start_end.nft b/tests/shell/testcases/sets/dumps/range_with_same_start_end.nft
new file mode 100644
index 000000000000..78979e9e0d5e
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/range_with_same_start_end.nft
@@ -0,0 +1,7 @@
+table ip t {
+	set X {
+		type inet_service
+		flags interval
+		elements = { 10, 30, 35 }
+	}
+}
diff --git a/tests/shell/testcases/sets/range_with_same_start_end b/tests/shell/testcases/sets/range_with_same_start_end
new file mode 100755
index 000000000000..127f0921f0de
--- /dev/null
+++ b/tests/shell/testcases/sets/range_with_same_start_end
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -e
+
+$NFT -f - <<EOF
+table ip t {
+	set X {
+		type inet_service
+		flags interval
+		elements = { 10, 30-30, 30, 35 }
+	}
+}
+EOF
-- 
2.45.3