[PATCH libftnl 09/12] src: set: check for empty list explicitly

[Florian Westphal <fw@strlen.de>]

LLM finding:
When s->expr_list is empty the for-init assigns
expr = container_of(&s->expr_list, nftnl_expr, head).

Since `head` is at offset 0 in nftnl_expr, this yields
expr == (nftnl_expr*)&s->expr_list: a pointer into the middle of the
nftnl_set struct.

The function returns this bogus pointer.
Also set data_len to 0; normally users would use the _str getter
which ignores the data_len anyway, but its better to initialise it
to a known value.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/set.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/set.c b/src/set.c
index fc50f3f28055..f06223eaed86 100644
--- a/src/set.c
+++ b/src/set.c
@@ -253,8 +253,6 @@ EXPORT_SYMBOL(nftnl_set_get_data);
 const void *nftnl_set_get_data(const struct nftnl_set *s, uint16_t attr,
 			       uint32_t *data_len)
 {
-	struct nftnl_expr *expr;
-
 	if (!(s->flags & (1 << attr)))
 		return NULL;
 
@@ -313,9 +311,11 @@ const void *nftnl_set_get_data(const struct nftnl_set *s, uint16_t attr,
 	case NFTNL_SET_USERDATA:
 		return nftnl_mem_blob_get(&s->user_data, data_len);
 	case NFTNL_SET_EXPR:
-		list_for_each_entry(expr, &s->expr_list, head)
-			break;
-		return expr;
+		*data_len = 0;
+		if (list_empty(&s->expr_list))
+			return NULL;
+
+		return list_entry(s->expr_list.next, struct nftnl_expr, head);
 	}
 	return NULL;
 }
-- 
2.55.0