From 31d874c2e45958af8f3ed6015d6ab8626ab0e48b Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Mon, 4 Dec 2023 22:00:06 +0100 Subject: [PATCH] evaluate: reject attempt to update a set commit 5f43ea807bb0f5b30f332c2c96f13e33c9243d22 upstream. This will crash as set->data is NULL, so check that SET_REF is pointing to a map: Error: candidates_ipv4 is not a map tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10 :0004 timeout 1s } ~~~~~~~~~~~~~~~~ Signed-off-by: Florian Westphal --- src/evaluate.c | 4 ++++ tests/shell/testcases/bogons/nft-f/add_to_a_set_crash | 11 +++++++++++ 2 files changed, 15 insertions(+) create mode 100644 tests/shell/testcases/bogons/nft-f/add_to_a_set_crash diff --git a/src/evaluate.c b/src/evaluate.c index 777daa43..639bc012 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -4066,6 +4066,10 @@ static int stmt_evaluate_map(struct eval_ctx *ctx, struct stmt *stmt) return expr_error(ctx->msgs, stmt->map.set, "Expression does not refer to a set"); + if (!set_is_map(stmt->map.set->set->flags)) + return expr_error(ctx->msgs, stmt->map.set, + "%s is not a map", stmt->map.set->set->handle.set.name); + if (stmt_evaluate_key(ctx, stmt, stmt->map.set->set->key->dtype, stmt->map.set->set->key->len, diff --git a/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash b/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash new file mode 100644 index 00000000..80a01b45 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/add_to_a_set_crash @@ -0,0 +1,11 @@ +table t { + set candidates_ipv4 { + type ipv4_addr . inet_service + size 65535 + flags dynamic,timeout + } + + chain input { + tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10 :0004 timeout 1s } + } +} -- 2.47.3