From: Phil Sutter <phil@nwl.cc>
Date: Fri, 11 Jun 2021 14:07:02 +0000 (+0200)
Subject: parser_json: Fix for memleak in tcp option error path
X-Git-Tag: v1.0.0~76
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f7b0eef8391ae7f89a3a82f6eeecaebe199224d7;p=thirdparty%2Fnftables.git

parser_json: Fix for memleak in tcp option error path

If 'kind' value is invalid, the function returned without freeing 'expr'
first. Fix this by performing the check before allocation.

Fixes: cb21869649208 ("json: tcp: add raw tcp option match support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/src/parser_json.c b/src/parser_json.c
index e6a0233a..bb0e4169 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -603,12 +603,12 @@ static struct expr *json_parse_tcp_option_expr(struct json_ctx *ctx,
 			"base", &kind, "offset", &offset, "len", &len)) {
 		uint32_t flag = 0;
 
-		expr = tcpopt_expr_alloc(int_loc, kind,
-					 TCPOPT_COMMON_KIND);
-
 		if (kind < 0 || kind > 255)
 			return NULL;
 
+		expr = tcpopt_expr_alloc(int_loc, kind,
+					 TCPOPT_COMMON_KIND);
+
 		if (offset == TCPOPT_COMMON_KIND && len == 8)
 			flag = NFT_EXTHDR_F_PRESENT;