From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 17 Jul 2015 12:38:37 +0000 (+0200)
Subject: netlink_delinearize: meta l4proto range printing broken on 32bit
X-Git-Tag: v0.5~32
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=efd09355038d53fdd3841ab5ccae1543c4967daf;p=thirdparty%2Fnftables.git

netlink_delinearize: meta l4proto range printing broken on 32bit

Florian Westphal says:

09565a4b1ed4863d44c4509a93c50f44efd12771 ("netlink_delinearize: consolidate
range printing") causes nft to segfault on 32bit machine when printing l4proto
ranges.

The problem is that meta_expr_pctx_update() assumes that right is a value, but
after this change it can also be a range.

Thus, expr->value contents are undefined (its union).  On x86_64 this is also
broken but by virtue of struct layout and pointer sizes, value->_mp_size will
almost always be 0 so mpz_get_uint8() returns 0.

But on x86-32 _mp_size will be huge value (contains expr->right pointer of
range), so we crash in libgmp.

Pablo says:

We shouldn't call pctx_update(), before the transformation we had
there a expr->op == { OP_GT, OP_GTE, OP_LT, OP_LTE }. So we never
entered that path as the assert in payload_expr_pctx_update()
indicates.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Florian Westphal <fw@strlen.de>
---

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 6d60be32..4226b822 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -983,6 +983,9 @@ static void meta_match_postprocess(struct rule_pp_ctx *ctx,
 
 	switch (expr->op) {
 	case OP_EQ:
+		if (expr->right->ops->type == EXPR_RANGE)
+			break;
+
 		expr->left->ops->pctx_update(&ctx->pctx, expr);
 
 		if (ctx->pbase == PROTO_BASE_INVALID &&