From cc70f19e588a0a33ed86c4a059b56a8f5b0c7a82 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 27 Jan 2020 16:11:41 +0100 Subject: [PATCH] netlink: Fix leak in unterminated string deserializer Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1793030 Upstream Status: nftables commit c3f6be3f2dced commit c3f6be3f2dcedf6d79751c0b975315ebc3184364 Author: Phil Sutter Date: Mon Jan 20 13:52:10 2020 +0100 netlink: Fix leak in unterminated string deserializer Allocated 'mask' expression is not freed before returning to caller, although it is used temporarily only. Fixes: b851ba4731d9f ("src: add interface wildcard matching") Signed-off-by: Phil Sutter Acked-by: Pablo Neira Ayuso --- src/netlink_delinearize.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 154353b..06a0312 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -2030,7 +2030,7 @@ static bool __expr_postprocess_string(struct expr **exprp) static struct expr *expr_postprocess_string(struct expr *expr) { - struct expr *mask; + struct expr *mask, *out; assert(expr_basetype(expr)->type == TYPE_STRING); if (__expr_postprocess_string(&expr)) @@ -2040,7 +2040,9 @@ static struct expr *expr_postprocess_string(struct expr *expr) BYTEORDER_HOST_ENDIAN, expr->len + BITS_PER_BYTE, NULL); mpz_init_bitmask(mask->value, expr->len); - return string_wildcard_expr_alloc(&expr->location, mask, expr); + out = string_wildcard_expr_alloc(&expr->location, mask, expr); + expr_free(mask); + return out; } static void expr_postprocess(struct rule_pp_ctx *ctx, struct expr **exprp) -- 1.8.3.1