From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 17 Oct 2017 10:25:00 +0000 (+0200)
Subject: netlink: fix element addition to map with stateful object
X-Git-Tag: v0.8.1~49
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0d2b22cbd57b2f0c617e0bdd5a0c8d2dce284882;p=thirdparty%2Fnftables.git

netlink: fix element addition to map with stateful object

Expressions with EXPR_F_INTERVAL_END flag set on have no right hand side,
so they store no stateful object. Skip them so we don't crash on this.

 # nft add map x testmap { type inet_service: counter\; flags interval\;}
 # nft add counter x testcounter
 # nft add element x testmap { 0-100 : "testcounter" }
 Segmentation fault

This patch also fixes the listing codepath.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1190
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/src/netlink.c b/src/netlink.c
index d5d410a84..e8d0e3134 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -261,7 +261,7 @@ static struct nftnl_set_elem *alloc_nftnl_setelem(const struct expr *set,
 			break;
 		}
 	}
-	if (set->set_flags & NFT_SET_OBJECT) {
+	if (set->set_flags & NFT_SET_OBJECT && data != NULL) {
 		netlink_gen_data(data, &nld);
 		nftnl_set_elem_set(nlse, NFTNL_SET_ELEM_OBJREF,
 				   nld.value, nld.len);
@@ -1595,8 +1595,13 @@ static int netlink_delinearize_setelem(struct nftnl_set_elem *nlse,
 		expr = mapping_expr_alloc(&netlink_location, expr, data);
 	}
 	if (set->flags & NFT_SET_OBJECT) {
-		nld.value = nftnl_set_elem_get(nlse, NFTNL_SET_ELEM_OBJREF,
-					       &nld.len);
+		if (nftnl_set_elem_is_set(nlse, NFTNL_SET_ELEM_OBJREF)) {
+			nld.value = nftnl_set_elem_get(nlse,
+						       NFTNL_SET_ELEM_OBJREF,
+						       &nld.len);
+		} else
+			goto out;
+
 		data = netlink_alloc_value(&netlink_location, &nld);
 		data->dtype = &string_type;
 		data->byteorder = BYTEORDER_HOST_ENDIAN;