hash: Fix potential null-pointer dereference in hash_expr_cmp()

The first part of the conditional:

| (e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr))

will call expr_cmp() in case e1->hash.expr is NULL, causing null-pointer
dereference. This is probably a typo, the intention when introducing
this was to avoid the call to expr_cmp() for symmetric hash expressions
which don't use expr->hash.expr. Inverting the existence check should
fix this.

Fixes: 3a86406729782 ("src: hash: support of symmetric hash")
Cc: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/hash.c b/src/hash.c
index 3355cadd1df2f38441eb60668ff5b0ff69e180f8..e6999637566c315ab68cc32f59c31128784eb4b9 100644 (file)
--- a/src/hash.c
+++ b/src/hash.c
@@ -36,7 +36,7 @@ static void hash_expr_print(const struct expr *expr, struct output_ctx *octx)
 
 static bool hash_expr_cmp(const struct expr *e1, const struct expr *e2)
 {
-       return (e1->hash.expr ||
+       return (!e1->hash.expr ||
                expr_cmp(e1->hash.expr, e2->hash.expr)) &&
               e1->hash.mod == e2->hash.mod &&
               e1->hash.seed_set == e2->hash.seed_set &&