netlink: fix element addition to map with stateful object

Expressions with EXPR_F_INTERVAL_END flag set on have no right hand side,
so they store no stateful object. Skip them so we don't crash on this.

 # nft add map x testmap { type inet_service: counter\; flags interval\;}
 # nft add counter x testcounter
 # nft add element x testmap { 0-100 : "testcounter" }
 Segmentation fault

This patch also fixes the listing codepath.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1190
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink.c b/src/netlink.c
index d5d410a847624e2f5988913410baeac4977e00c0..e8d0e31348f010df34bef03a3f7cf845fec9a6f9 100644 (file)
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -261,7 +261,7 @@ static struct nftnl_set_elem *alloc_nftnl_setelem(const struct expr *set,
                        break;
                }
        }
-       if (set->set_flags & NFT_SET_OBJECT) {
+       if (set->set_flags & NFT_SET_OBJECT && data != NULL) {
                netlink_gen_data(data, &nld);
                nftnl_set_elem_set(nlse, NFTNL_SET_ELEM_OBJREF,
                                   nld.value, nld.len);
@@ -1595,8 +1595,13 @@ static int netlink_delinearize_setelem(struct nftnl_set_elem *nlse,
                expr = mapping_expr_alloc(&netlink_location, expr, data);
        }
        if (set->flags & NFT_SET_OBJECT) {
-               nld.value = nftnl_set_elem_get(nlse, NFTNL_SET_ELEM_OBJREF,
-                                              &nld.len);
+               if (nftnl_set_elem_is_set(nlse, NFTNL_SET_ELEM_OBJREF)) {
+                       nld.value = nftnl_set_elem_get(nlse,
+                                                      NFTNL_SET_ELEM_OBJREF,
+                                                      &nld.len);
+               } else
+                       goto out;
+
                data = netlink_alloc_value(&netlink_location, &nld);
                data->dtype = &string_type;
                data->byteorder = BYTEORDER_HOST_ENDIAN;