|
 |
ad45ff |
From 76a8ca39b3f95b898cd92546fb87ccaa2d1922c7 Mon Sep 17 00:00:00 2001
|
|
|
ad45ff |
From: Phil Sutter <psutter@redhat.com>
|
|
|
ad45ff |
Date: Wed, 20 Jun 2018 09:22:47 +0200
|
|
|
ad45ff |
Subject: [PATCH] hash: Fix potential null-pointer dereference in
|
|
|
ad45ff |
hash_expr_cmp()
|
|
|
ad45ff |
|
|
|
ad45ff |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1504157
|
|
|
ad45ff |
Upstream Status: nftables commit 5043a1e4847c0
|
|
|
ad45ff |
|
|
|
ad45ff |
commit 5043a1e4847c0149dabaf0b529a14a43b957e5e4
|
|
|
ad45ff |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
ad45ff |
Date: Thu Mar 1 15:00:30 2018 +0100
|
|
|
ad45ff |
|
|
|
ad45ff |
hash: Fix potential null-pointer dereference in hash_expr_cmp()
|
|
|
ad45ff |
|
|
|
ad45ff |
The first part of the conditional:
|
|
|
ad45ff |
|
|
|
ad45ff |
| (e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr))
|
|
|
ad45ff |
|
|
|
ad45ff |
will call expr_cmp() in case e1->hash.expr is NULL, causing null-pointer
|
|
|
ad45ff |
dereference. This is probably a typo, the intention when introducing
|
|
|
ad45ff |
this was to avoid the call to expr_cmp() for symmetric hash expressions
|
|
|
ad45ff |
which don't use expr->hash.expr. Inverting the existence check should
|
|
|
ad45ff |
fix this.
|
|
|
ad45ff |
|
|
|
ad45ff |
Fixes: 3a86406729782 ("src: hash: support of symmetric hash")
|
|
|
ad45ff |
Cc: Laura Garcia Liebana <nevola@gmail.com>
|
|
|
ad45ff |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
ad45ff |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
ad45ff |
---
|
|
|
ad45ff |
src/hash.c | 2 +-
|
|
|
ad45ff |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
ad45ff |
|
|
|
ad45ff |
diff --git a/src/hash.c b/src/hash.c
|
|
|
ad45ff |
index 3355cad..e699963 100644
|
|
|
ad45ff |
--- a/src/hash.c
|
|
|
ad45ff |
+++ b/src/hash.c
|
|
|
ad45ff |
@@ -36,7 +36,7 @@ static void hash_expr_print(const struct expr *expr, struct output_ctx *octx)
|
|
|
ad45ff |
|
|
|
ad45ff |
static bool hash_expr_cmp(const struct expr *e1, const struct expr *e2)
|
|
|
ad45ff |
{
|
|
|
ad45ff |
- return (e1->hash.expr ||
|
|
|
ad45ff |
+ return (!e1->hash.expr ||
|
|
|
ad45ff |
expr_cmp(e1->hash.expr, e2->hash.expr)) &&
|
|
|
ad45ff |
e1->hash.mod == e2->hash.mod &&
|
|
|
ad45ff |
e1->hash.seed_set == e2->hash.seed_set &&
|
|
|
ad45ff |
--
|
|
|
ad45ff |
1.8.3.1
|
|
|
ad45ff |
|