netlink_delinearize: use-after-free in expr_postprocess_string()

escaped_string_wildcard_expr_alloc() may reallocate the expression.
valgrind reports errors like this one:

==29945== Invalid write of size 4
==29945==    at 0x72EE944: __expr_postprocess_string (netlink_delinearize.c:2006)
==29945==    by 0x72EE944: expr_postprocess_string (netlink_delinearize.c:2016)
==29945==    by 0x72EE944: expr_postprocess (netlink_delinearize.c:2120)
==29945==    by 0x72EE5A7: expr_postprocess (netlink_delinearize.c:2094)
==29945==    by 0x72EF23B: stmt_expr_postprocess (netlink_delinearize.c:2289)
==29945==    by 0x72EF23B: rule_parse_postprocess (netlink_delinearize.c:2510)
==29945==    by 0x72EF23B: netlink_delinearize_rule (netlink_delinearize.c:2650)
==29945==    by 0x72E6F63: list_rule_cb (netlink.c:330)
==29945==    by 0x7770BD3: nftnl_rule_list_foreach (rule.c:810)
==29945==    by 0x72E739E: netlink_list_rules (netlink.c:349)
==29945==    by 0x72E739E: netlink_list_table (netlink.c:490)
==29945==    by 0x72D4A89: cache_init_objects (rule.c:194)
==29945==    by 0x72D4A89: cache_init (rule.c:216)
==29945==    by 0x72D4A89: cache_update (rule.c:266)
==29945==    by 0x72F829E: nft_evaluate (libnftables.c:388)
==29945==    by 0x72F8A5B: nft_run_cmd_from_buffer (libnftables.c:428)

Remove expr->len, not needed and it triggers use-after-free errors.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 6576687ce627f5c5ee0ca90f65e887ddccb4796f..1f63d9d5e2c2f426245ffee01618855fa6eca029 100644 (file)
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -2003,7 +2003,6 @@ static bool __expr_postprocess_string(struct expr **exprp)
                escaped_string_wildcard_expr_alloc(exprp, len);
 
        mpz_clear(tmp);
-       expr->len = len;
 
        return nulterminated;
 }
@@ -2119,6 +2118,7 @@ static void expr_postprocess(struct rule_pp_ctx *ctx, struct expr **exprp)
                if (expr_basetype(expr)->type == TYPE_STRING)
                        *exprp = expr_postprocess_string(expr);
 
+               expr = *exprp;
                if (expr->dtype->basetype != NULL &&
                    expr->dtype->basetype->type == TYPE_BITMASK)
                        *exprp = bitmask_expr_to_binops(expr);