* [PATCH nft] netlink_delinearize: prune implicit binop before payload_match_postprocess()
@ 2016-02-01 13:32 Pablo Neira Ayuso
2016-02-01 13:50 ` Florian Westphal
0 siblings, 1 reply; 2+ messages in thread
From: Pablo Neira Ayuso @ 2016-02-01 13:32 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
payload_match_postprocess() expects a relational with payload of his lhs
and value on the rhs.
Moreover, payload_match_expand() releases the previous expression so
valgrind reports an use-after-free when pruning the implicit binop.
Fix this by calling payload_match_postprocess() in first place.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
src/netlink_delinearize.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 7d94f30..ae6abb0 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -1229,13 +1229,12 @@ static void binop_postprocess(struct rule_pp_ctx *ctx, struct expr *expr)
value->len = payload->len;
}
- payload_match_postprocess(ctx, expr, payload);
-
assert(expr->left->ops->type == EXPR_BINOP);
-
assert(binop->left == payload);
expr->left = expr_get(payload);
expr_free(binop);
+
+ payload_match_postprocess(ctx, expr, payload);
}
}
--
2.1.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-02-01 13:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-01 13:32 [PATCH nft] netlink_delinearize: prune implicit binop before payload_match_postprocess() Pablo Neira Ayuso
2016-02-01 13:50 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).