]> git.ipfire.org Git - thirdparty/nftables.git/commit
parser_json: initialize geneve options list for empty tunnel array
authorOmkhar Arasaratnam <omkhar@linkedin.com>
Wed, 8 Jul 2026 23:09:52 +0000 (23:09 +0000)
committerFlorian Westphal <fw@strlen.de>
Thu, 9 Jul 2026 08:03:52 +0000 (10:03 +0200)
commite052d61a144fc4ad1aa6e68d65993420865fa5cb
tree18dd57294778e15cb504091ff336d056f45432cb
parent7c68fe8a2e002f17d6166048fb21494bc86fc270
parser_json: initialize geneve options list for empty tunnel array

json_parse_cmd_add_object() only initializes obj->tunnel.geneve_opts on
the first iteration of the json_array_foreach() loop, guarded by
"if (index == 0)". A geneve tunnel object whose options array is empty
("tunnel": []) never enters the loop, so the list head is left
uninitialized. obj_tunnel_add_opts() (src/mnl.c) later walks it with
list_for_each_entry() and passes the bogus element to libnftnl, which
dereferences the near-NULL pointer and crashes nft:

  # nft -j -f empty_geneve.json
  AddressSanitizer: SEGV on unknown address 0x000000000012
    #1 nftnl_tunnel_opt_geneve_set  obj/tunnel.c:880
    #2 nftnl_tunnel_opt_set         obj/tunnel.c:910
    #3 obj_tunnel_add_opts          src/mnl.c:1608
    #4 mnl_nft_obj_add              src/mnl.c:1757
    #5 do_command_add               src/rule.c:1542

Initialize the list head unconditionally before the loop and drop the
per-iteration guard, so an empty array leaves a valid empty list. The
equivalent native-syntax empty definition was already handled in commit
f9047c1f ("evaluate: tunnel: don't assume src is set"); this covers the
JSON parser path, which that fix did not reach.

Fixes: 3a957f8f1ff1 ("tunnel: add tunnel object and statement json support")
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
src/parser_json.c
tests/shell/testcases/bogons/nft-j-f/empty_tunnel_option_array [new file with mode: 0644]