From: Phil Sutter <phil@nwl.cc>
Date: Wed, 24 Apr 2024 21:35:00 +0000 (+0200)
Subject: json: Fix for memleak in __binop_expr_json
X-Git-Tag: v1.0.6.1~212
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ef97f6aec2e093f5f23a555cde4b6b581c067617;p=thirdparty%2Fnftables.git

json: Fix for memleak in __binop_expr_json

commit a0a15e4dd0576bc4efd9b01fdd4ee1c565effac9 upstream.

When merging the JSON arrays generated for LHS and RHS of nested binop
expressions, the emptied array objects leak if their reference is not
decremented.

Fix this and tidy up other spots which did it right already by
introducing a json_array_extend wrapper.

Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Fixes: 0ac39384fd9e4 ("json: Accept more than two operands in binary expressions")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/src/json.c b/src/json.c
index f2625046..e950157f 100644
--- a/src/json.c
+++ b/src/json.c
@@ -33,6 +33,15 @@
 })
 #endif
 
+static int json_array_extend_new(json_t *array, json_t *other_array)
+{
+	int ret;
+
+	ret = json_array_extend(array, other_array);
+	json_decref(other_array);
+	return ret;
+}
+
 static json_t *expr_print_json(const struct expr *expr, struct output_ctx *octx)
 {
 	const struct expr_ops *ops;
@@ -536,8 +545,10 @@ __binop_expr_json(int op, const struct expr *expr, struct output_ctx *octx)
 	json_t *a = json_array();
 
 	if (expr->etype == EXPR_BINOP && expr->op == op) {
-		json_array_extend(a, __binop_expr_json(op, expr->left, octx));
-		json_array_extend(a, __binop_expr_json(op, expr->right, octx));
+		json_array_extend_new(a,
+				      __binop_expr_json(op, expr->left, octx));
+		json_array_extend_new(a,
+				      __binop_expr_json(op, expr->right, octx));
 	} else {
 		json_array_append_new(a, expr_print_json(expr, octx));
 	}
@@ -1713,8 +1724,7 @@ static json_t *table_print_json_full(struct netlink_ctx *ctx,
 		}
 	}
 
-	json_array_extend(root, rules);
-	json_decref(rules);
+	json_array_extend_new(root, rules);
 
 	return root;
 }
@@ -1722,7 +1732,7 @@ static json_t *table_print_json_full(struct netlink_ctx *ctx,
 static json_t *do_list_ruleset_json(struct netlink_ctx *ctx, struct cmd *cmd)
 {
 	unsigned int family = cmd->handle.family;
-	json_t *root = json_array(), *tmp;
+	json_t *root = json_array();
 	struct table *table;
 
 	list_for_each_entry(table, &ctx->nft->cache.table_cache.list, cache.list) {
@@ -1730,9 +1740,7 @@ static json_t *do_list_ruleset_json(struct netlink_ctx *ctx, struct cmd *cmd)
 		    table->handle.family != family)
 			continue;
 
-		tmp = table_print_json_full(ctx, table);
-		json_array_extend(root, tmp);
-		json_decref(tmp);
+		json_array_extend_new(root, table_print_json_full(ctx, table));
 	}
 
 	return root;