monitor: Fix for use after free when printing map elements

When populating the dummy set, 'data' field must be cloned just like
'key' field.

Fixes: 343a51702656a ("src: store expr, not dtype to track data in sets")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/monitor.c b/src/monitor.c
index 84505eb914bf61c119f801432dc28533d8c97642..53a8bcd4641d1ea49dcc7cd22f56840c548d2da9 100644 (file)
--- a/src/monitor.c
+++ b/src/monitor.c
@@ -401,7 +401,8 @@ static int netlink_events_setelem_cb(const struct nlmsghdr *nlh, int type,
         */
        dummyset = set_alloc(monh->loc);
        dummyset->key = expr_clone(set->key);
-       dummyset->data = set->data;
+       if (set->data)
+               dummyset->data = expr_clone(set->data);
        dummyset->flags = set->flags;
        dummyset->init = set_expr_alloc(monh->loc, set);