[nft PATCH 1/3] parser_json: Avoid storage leak in json_parse_set_expr error path

[Phil Sutter <phil@nwl.cc>]

If parsing jright fails, code frees 'expr' and 'set_expr' before
returning but 'elem' may have been allocated as well. To avoid extra
conditionals when freeing it, parse jright earlier so the code following
conditional 'elem' allocation becomes error-path-free.

Fixes: 144d97e151adb ("src: normalize set element with EXPR_MAPPING")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 src/parser_json.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/parser_json.c b/src/parser_json.c
index 14259ea39777b..224cbb79de1b8 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -1493,13 +1493,6 @@ static struct expr *json_parse_set_expr(struct json_ctx *ctx,
 				return NULL;
 			}
 
-			if (expr->etype != EXPR_SET_ELEM) {
-				elem = set_elem_expr_alloc(int_loc, expr);
-			} else {
-				elem = expr;
-				expr = expr->key;
-			}
-
 			expr2 = json_parse_set_rhs_expr(ctx, jright);
 			if (!expr2) {
 				json_error(ctx, "Invalid set elem at index %zu.", index);
@@ -1507,6 +1500,14 @@ static struct expr *json_parse_set_expr(struct json_ctx *ctx,
 				expr_free(set_expr);
 				return NULL;
 			}
+
+			if (expr->etype != EXPR_SET_ELEM) {
+				elem = set_elem_expr_alloc(int_loc, expr);
+			} else {
+				elem = expr;
+				expr = expr->key;
+			}
+
 			expr2 = mapping_expr_alloc(int_loc, expr, expr2);
 			elem->key = expr2;
 			expr = elem;
-- 
2.54.0