From: Phil Sutter <phil@nwl.cc>
Date: Mon, 6 Aug 2018 15:23:23 +0000 (+0200)
Subject: xtables: Fix potential segfault in nft_rule_append()
X-Git-Tag: v1.8.1~82
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a9d9f64b7c06c17c98c175f1c44e8979ba0e14c3;p=thirdparty%2Fiptables.git

xtables: Fix potential segfault in nft_rule_append()

If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the
rule and then tries to add it to the rule cache. Better return 0
(failure) instead of continuing.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
---

diff --git a/iptables/nft.c b/iptables/nft.c
index b893859d..1c076510 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1173,8 +1173,10 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
 	} else
 		type = NFT_COMPAT_RULE_APPEND;
 
-	if (batch_rule_add(h, type, r) < 0)
+	if (batch_rule_add(h, type, r) < 0) {
 		nftnl_rule_free(r);
+		return 0;
+	}
 
 	if (verbose)
 		h->ops->print_rule(r, 0, FMT_PRINT_RULE);