From: Liping Zhang <zlpnobody@gmail.com>
Date: Sat, 11 Mar 2017 04:20:11 +0000 (+0800)
Subject: src: fix crash when inputting an incomplete set add command
X-Git-Tag: v0.8~208
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c6cd7c22548a;p=thirdparty%2Fnftables.git

src: fix crash when inputting an incomplete set add command

After inputting the following nft command, set->keytype is not initialized
but we try to destroy it, so NULL pointer dereference will happen:
  # nft add set t s
  Segmentation fault (core dumped)
  #0  dtype_free (dtype=0x0) at datatype.c:1049
  #1  set_datatype_destroy (dtype=0x0) at datatype.c:1051
  #2  0x0000000000407f1a in set_free (set=0x838790) at rule.c:213
  #3  0x000000000042ff70 in nft_parse (scanner=scanner@entry=0x8386a0,
    state=state@entry=0x7ffc313ea670) at parser_bison.c:9355
  #4  0x000000000040727d in nft_run (scanner=scanner@entry=0x8386a0,
    state=state@entry=0x7ffc313ea670, msgs=msgs@entry=0x7ffc313ea660)
    at main.c:237
  #5  0x0000000000406e4a in main (argc=<optimized out>, argv=<optimized
    out>) at main.c:376

Fixes: b9b6092304ae ("evaluate: store byteorder for set keys")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/src/datatype.c b/src/datatype.c
index c61c4245..06a045bc 100644
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -1047,7 +1047,7 @@ const struct datatype *set_datatype_alloc(const struct datatype *orig_dtype,
 
 void set_datatype_destroy(const struct datatype *dtype)
 {
-	if (dtype->flags & DTYPE_F_CLONE)
+	if (dtype && dtype->flags & DTYPE_F_CLONE)
 		dtype_free(dtype);
 }
 
diff --git a/src/rule.c b/src/rule.c
index f5ff1103..056d5ce8 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -211,8 +211,7 @@ void set_free(struct set *set)
 		expr_free(set->init);
 	handle_free(&set->handle);
 	set_datatype_destroy(set->keytype);
-	if (set->datatype)
-		set_datatype_destroy(set->datatype);
+	set_datatype_destroy(set->datatype);
 	xfree(set);
 }