src: fix crash when inputting an incomplete set add command

After inputting the following nft command, set->keytype is not initialized
but we try to destroy it, so NULL pointer dereference will happen:
  # nft add set t s
  Segmentation fault (core dumped)
  #0  dtype_free (dtype=0x0) at datatype.c:1049
  #1  set_datatype_destroy (dtype=0x0) at datatype.c:1051
  #2  0x0000000000407f1a in set_free (set=0x838790) at rule.c:213
  #3  0x000000000042ff70 in nft_parse (scanner=scanner@entry=0x8386a0,
    state=state@entry=0x7ffc313ea670) at parser_bison.c:9355
  #4  0x000000000040727d in nft_run (scanner=scanner@entry=0x8386a0,
    state=state@entry=0x7ffc313ea670, msgs=msgs@entry=0x7ffc313ea660)
    at main.c:237
  #5  0x0000000000406e4a in main (argc=<optimized out>, argv=<optimized
    out>) at main.c:376

Fixes: b9b6092304ae ("evaluate: store byteorder for set keys")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/datatype.c b/src/datatype.c
index c61c4245c386887386b0d8d2b53077bd741e77c7..06a045bc03aedac33a53d427d9972c3fbe2a219b 100644 (file)
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -1047,7 +1047,7 @@ const struct datatype *set_datatype_alloc(const struct datatype *orig_dtype,
 
 void set_datatype_destroy(const struct datatype *dtype)
 {
-       if (dtype->flags & DTYPE_F_CLONE)
+       if (dtype && dtype->flags & DTYPE_F_CLONE)
                dtype_free(dtype);
 }
 

diff --git a/src/rule.c b/src/rule.c
index f5ff1103c9f1362fe08a1432d94d8896d8a8f04c..056d5ce8394e497eea4848a5ff0e3599c788b6c8 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -211,8 +211,7 @@ void set_free(struct set *set)
                expr_free(set->init);
        handle_free(&set->handle);
        set_datatype_destroy(set->keytype);
-       if (set->datatype)
-               set_datatype_destroy(set->datatype);
+       set_datatype_destroy(set->datatype);
        xfree(set);
 }