netlink_delinearize: release expression before calling netlink_parse_concat_expr()

netlink_get_register() clones the expression in the register. Release
this expression before calling netlink_parse_concat_expr() to
deconstruct the concatenation.

==15069==    at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==15069==    by 0x4E79508: xmalloc (utils.c:36)
==15069==    by 0x4E795ED: xzalloc (utils.c:65)
==15069==    by 0x4E6029B: dtype_alloc (datatype.c:1073)
==15069==    by 0x4E6029B: concat_type_alloc (datatype.c:1127)
==15069==    by 0x4E6D3B3: netlink_delinearize_set (netlink.c:578)
==15069==    by 0x4E6D68E: list_set_cb (netlink.c:648)
==15069==    by 0x5F34023: nftnl_set_list_foreach (set.c:780)
==15069==    by 0x4E6D6F3: netlink_list_sets (netlink.c:669)
==15069==    by 0x4E5A7A3: cache_init_objects (rule.c:159)
==15069==    by 0x4E5A7A3: cache_init (rule.c:216)
==15069==    by 0x4E5A7A3: cache_update (rule.c:266)
==15069==    by 0x4E7E09E: nft_evaluate (libnftables.c:388)
==15069==    by 0x4E7E85B: nft_run_cmd_from_buffer (libnftables.c:428)

Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index a1c775e679e40ad521afc56861b9f0cdf3048e07..0270e1fd7067694ccc3e191c41db0bc5e851b0f9 100644 (file)
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -293,6 +293,7 @@ static void netlink_parse_cmp(struct netlink_parse_ctx *ctx,
            expr_basetype(left) != &string_type) {
                return netlink_error(ctx, loc, "Relational expression size mismatch");
        } else if (left->len > 0 && left->len < right->len) {
+               expr_free(left);
                left = netlink_parse_concat_expr(ctx, loc, sreg, right->len);
                if (left == NULL)
                        return;
@@ -329,6 +330,7 @@ static void netlink_parse_lookup(struct netlink_parse_ctx *ctx,
                                     "Lookup expression has no left hand side");
 
        if (left->len < set->key->len) {
+               expr_free(left);
                left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len);
                if (left == NULL)
                        return;
@@ -1317,6 +1319,7 @@ static void netlink_parse_dynset(struct netlink_parse_ctx *ctx,
                                     "Dynset statement has no key expression");
 
        if (expr->len < set->key->len) {
+               expr_free(expr);
                expr = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len);
                if (expr == NULL)
                        return;
@@ -1408,6 +1411,7 @@ static void netlink_parse_objref(struct netlink_parse_ctx *ctx,
                                             "objref expression has no left hand side");
 
                if (left->len < set->key->len) {
+                       expr_free(left);
                        left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len);
                        if (left == NULL)
                                return;