expression: don't try to import empty string

The bogon will trigger the assertion in mpz_import_data:
src/expression.c:418: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed.

Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/expression.c b/src/expression.c
index 228754fc2067e732bac334ded211fd6a5fffca8f..9f19a379df0f5c89f0241c22303963590e5a5016 100644 (file)
--- a/src/expression.c
+++ b/src/expression.c
@@ -494,7 +494,7 @@ struct expr *constant_expr_alloc(const struct location *loc,
        expr->flags = EXPR_F_CONSTANT | EXPR_F_SINGLETON;
 
        mpz_init2(expr->value, len);
-       if (data != NULL)
+       if (data != NULL && len)
                mpz_import_data(expr->value, data, byteorder,
                                div_round_up(len, BITS_PER_BYTE));
 

diff --git a/tests/shell/testcases/bogons/nft-j-f/constant_expr_alloc_assert b/tests/shell/testcases/bogons/nft-j-f/constant_expr_alloc_assert
new file mode 100644 (file)
index 0000000..9c40030
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-j-f/constant_expr_alloc_assert
@@ -0,0 +1,38 @@
+{
+  "nftables": [
+    {
+      "table": {
+        "family": "ip",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "t",
+        "name": "testchain",
+        "handle": 0
+      }
+    },
+    {
+      "map": {
+        "family": "ip",
+        "name": "testmap",
+        "table": "t",
+        "type": "ipv4_addr",
+        "handle": 0,
+        "map": "verdict",
+        "elem": [
+          [
+            {
+              "jump": {
+                "target": ""
+              }
+            }
+          ]
+        ]
+      }
+    }
+  ]
+}