evaluate: don't crash if range has same start and end interval

In this case, evaluation step replaces the range expression with a
single value and we'd crash as range->left/right contain garbage
values.

Simply replace the input expression with the evaluation result.

Also add a test case modeled on the afl reproducer.

Fixes: fe6cc0ad29cd ("evaluate: consolidate evaluation of symbol range expression")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index e27d08ce7ef863b0f68aa7f832c372149861215d..722c11a23c2d34145897c7fc4834a30aa62e4524 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2351,6 +2351,10 @@ static int expr_evaluate_symbol_range(struct eval_ctx *ctx, struct expr **exprp)
                expr_free(range);
                return -1;
        }
+
+       if (range->etype != EXPR_RANGE)
+               goto out_done;
+
        left = range->left;
        right = range->right;
 
@@ -2371,6 +2375,7 @@ static int expr_evaluate_symbol_range(struct eval_ctx *ctx, struct expr **exprp)
                return 0;
        }
 
+out_done:
        expr_free(expr);
        *exprp = range;
 

diff --git a/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft b/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
new file mode 100644 (file)
index 0000000..c468247
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
@@ -0,0 +1,35 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "set": {
+        "family": "ip",
+        "name": "X",
+        "table": "t",
+        "type": "inet_service",
+        "handle": 0,
+        "flags": [
+          "interval"
+        ],
+        "elem": [
+          10,
+          30,
+          35
+        ]
+      }
+    }
+  ]
+}

diff --git a/tests/shell/testcases/sets/dumps/range_with_same_start_end.nft b/tests/shell/testcases/sets/dumps/range_with_same_start_end.nft
new file mode 100644 (file)
index 0000000..78979e9
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/range_with_same_start_end.nft
@@ -0,0 +1,7 @@
+table ip t {
+       set X {
+               type inet_service
+               flags interval
+               elements = { 10, 30, 35 }
+       }
+}

diff --git a/tests/shell/testcases/sets/range_with_same_start_end b/tests/shell/testcases/sets/range_with_same_start_end
new file mode 100755 (executable)
index 0000000..127f092
--- /dev/null
+++ b/tests/shell/testcases/sets/range_with_same_start_end
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -e
+
+$NFT -f - <<EOF
+table ip t {
+       set X {
+               type inet_service
+               flags interval
+               elements = { 10, 30-30, 30, 35 }
+       }
+}
+EOF