libsmartcols: fix SEGV in filter_compile_param()

The val union in filter_param can hold different types (str, num, fnum,
boolean). When a non-string param (e.g. a number) is used as a regex
operand, the numeric value gets reinterpreted as a pointer through
val.str. A small number like 2 becomes pointer 0x2, which passes the
existing NULL check but crashes in regcomp().

Add a type check to reject non-string params before accessing val.str.

Addresses: https://github.com/util-linux/util-linux/pull/4430
Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/libsmartcols/src/filter-param.c b/libsmartcols/src/filter-param.c
index 5a46ffa7dfce4613344a4529d6bb8267fafc8122..d83977bcf8b51f0674e45ffc028c50c4d4b3736b 100644 (file)
--- a/libsmartcols/src/filter-param.c
+++ b/libsmartcols/src/filter-param.c
@@ -126,9 +126,11 @@ int filter_compile_param(struct libscols_filter *fltr, struct filter_param *n)
 {
        int rc;
 
+       if (filter_node_get_type((struct filter_node *) n) != F_NODE_PARAM)
+               return -EINVAL;
        if (n->re)
                return 0;
-       if (!n->val.str)
+       if (n->type != SCOLS_DATA_STRING || !n->val.str)
                return -EINVAL;
 
        n->re = calloc(1, sizeof(regex_t));