From: Phil Sutter Date: Mon, 20 Jan 2020 15:32:40 +0000 (+0100) Subject: netlink: Avoid potential NULL-pointer deref in netlink_gen_payload_stmt() X-Git-Tag: v0.9.4~96 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c9ddf0bff363fc9101b563b592db600bdf4d65c5;p=thirdparty%2Fnftables.git netlink: Avoid potential NULL-pointer deref in netlink_gen_payload_stmt() With payload_needs_l4csum_update_pseudohdr() unconditionally dereferencing passed 'desc' parameter and a previous check for it to be non-NULL, make sure to call the function only if input is sane. Fixes: 68de70f2b3fc6 ("netlink_linearize: fix IPv6 layer 4 checksum mangling") Signed-off-by: Phil Sutter Acked-by: Pablo Neira Ayuso --- diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 498326d0..cb1b7fe1 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -941,7 +941,7 @@ static void netlink_gen_payload_stmt(struct netlink_linearize_ctx *ctx, nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_CSUM_OFFSET, csum_off / BITS_PER_BYTE); } - if (expr->payload.base == PROTO_BASE_NETWORK_HDR && + if (expr->payload.base == PROTO_BASE_NETWORK_HDR && desc && payload_needs_l4csum_update_pseudohdr(expr, desc)) nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS, NFT_PAYLOAD_L4CSUM_PSEUDOHDR);