parser_json: Duplicate chain name when parsing jump verdict

Since verdict expression frees the chain name, pass a newly allocated
string to it. Otherwise double free happens because json_decref() frees
the string property value as well.

Fixes: d1057a5feb5fd ("JSON: Simplify verdict statement parsing")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/parser_json.c b/src/parser_json.c
index d00cf422c314e6a9eca9b86853408915ebad8839..78214f6519f2bd9b5a281a181c23a7a191ed7b12 100644 (file)
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -1075,7 +1075,8 @@ static struct expr *json_parse_verdict_expr(struct json_ctx *ctx,
                        return NULL;
 
                return verdict_expr_alloc(int_loc,
-                                         verdict_tbl[i].verdict, chain);
+                                         verdict_tbl[i].verdict,
+                                         chain ? xstrdup(chain) : NULL);
        }
        json_error(ctx, "Unknown verdict '%s'.", type);
        return NULL;