json: Fix for memleak in __binop_expr_json

commit a0a15e4dd0576bc4efd9b01fdd4ee1c565effac9 upstream.

When merging the JSON arrays generated for LHS and RHS of nested binop
expressions, the emptied array objects leak if their reference is not
decremented.

Fix this and tidy up other spots which did it right already by
introducing a json_array_extend wrapper.

Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Fixes: 0ac39384fd9e4 ("json: Accept more than two operands in binary expressions")
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/src/json.c b/src/json.c
index f26250469fa04164ee67081d51d21968271427e9..e950157f1cd74dd6ffb332c787bb169dec4de58c 100644 (file)
--- a/src/json.c
+++ b/src/json.c
@@ -33,6 +33,15 @@
 })
 #endif
 
+static int json_array_extend_new(json_t *array, json_t *other_array)
+{
+       int ret;
+
+       ret = json_array_extend(array, other_array);
+       json_decref(other_array);
+       return ret;
+}
+
 static json_t *expr_print_json(const struct expr *expr, struct output_ctx *octx)
 {
        const struct expr_ops *ops;
@@ -536,8 +545,10 @@ __binop_expr_json(int op, const struct expr *expr, struct output_ctx *octx)
        json_t *a = json_array();
 
        if (expr->etype == EXPR_BINOP && expr->op == op) {
-               json_array_extend(a, __binop_expr_json(op, expr->left, octx));
-               json_array_extend(a, __binop_expr_json(op, expr->right, octx));
+               json_array_extend_new(a,
+                                     __binop_expr_json(op, expr->left, octx));
+               json_array_extend_new(a,
+                                     __binop_expr_json(op, expr->right, octx));
        } else {
                json_array_append_new(a, expr_print_json(expr, octx));
        }
@@ -1713,8 +1724,7 @@ static json_t *table_print_json_full(struct netlink_ctx *ctx,
                }
        }
 
-       json_array_extend(root, rules);
-       json_decref(rules);
+       json_array_extend_new(root, rules);
 
        return root;
 }
@@ -1722,7 +1732,7 @@ static json_t *table_print_json_full(struct netlink_ctx *ctx,
 static json_t *do_list_ruleset_json(struct netlink_ctx *ctx, struct cmd *cmd)
 {
        unsigned int family = cmd->handle.family;
-       json_t *root = json_array(), *tmp;
+       json_t *root = json_array();
        struct table *table;
 
        list_for_each_entry(table, &ctx->nft->cache.table_cache.list, cache.list) {
@@ -1730,9 +1740,7 @@ static json_t *do_list_ruleset_json(struct netlink_ctx *ctx, struct cmd *cmd)
                    table->handle.family != family)
                        continue;
 
-               tmp = table_print_json_full(ctx, table);
-               json_array_extend(root, tmp);
-               json_decref(tmp);
+               json_array_extend_new(root, table_print_json_full(ctx, table));
        }
 
        return root;