From: Phil Sutter Date: Thu, 1 Mar 2018 14:00:30 +0000 (+0100) Subject: hash: Fix potential null-pointer dereference in hash_expr_cmp() X-Git-Tag: v0.8.3~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5043a1e4847c0149dabaf0b529a14a43b957e5e4;p=thirdparty%2Fnftables.git hash: Fix potential null-pointer dereference in hash_expr_cmp() The first part of the conditional: | (e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr)) will call expr_cmp() in case e1->hash.expr is NULL, causing null-pointer dereference. This is probably a typo, the intention when introducing this was to avoid the call to expr_cmp() for symmetric hash expressions which don't use expr->hash.expr. Inverting the existence check should fix this. Fixes: 3a86406729782 ("src: hash: support of symmetric hash") Cc: Laura Garcia Liebana Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- diff --git a/src/hash.c b/src/hash.c index 3355cadd..e6999637 100644 --- a/src/hash.c +++ b/src/hash.c @@ -36,7 +36,7 @@ static void hash_expr_print(const struct expr *expr, struct output_ctx *octx) static bool hash_expr_cmp(const struct expr *e1, const struct expr *e2) { - return (e1->hash.expr || + return (!e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr)) && e1->hash.mod == e2->hash.mod && e1->hash.seed_set == e2->hash.seed_set &&