From: Karel Zak Date: Mon, 22 Jun 2026 08:41:51 +0000 (+0200) Subject: libsmartcols: fix SEGV in filter_compile_param() X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2857d9ce932730fa2d5dd3c1aeedf73cf38bdb06;p=thirdparty%2Futil-linux.git libsmartcols: fix SEGV in filter_compile_param() The val union in filter_param can hold different types (str, num, fnum, boolean). When a non-string param (e.g. a number) is used as a regex operand, the numeric value gets reinterpreted as a pointer through val.str. A small number like 2 becomes pointer 0x2, which passes the existing NULL check but crashes in regcomp(). Add a type check to reject non-string params before accessing val.str. Addresses: https://github.com/util-linux/util-linux/pull/4430 Signed-off-by: Karel Zak --- diff --git a/libsmartcols/src/filter-param.c b/libsmartcols/src/filter-param.c index 5a46ffa7d..d83977bcf 100644 --- a/libsmartcols/src/filter-param.c +++ b/libsmartcols/src/filter-param.c @@ -126,9 +126,11 @@ int filter_compile_param(struct libscols_filter *fltr, struct filter_param *n) { int rc; + if (filter_node_get_type((struct filter_node *) n) != F_NODE_PARAM) + return -EINVAL; if (n->re) return 0; - if (!n->val.str) + if (n->type != SCOLS_DATA_STRING || !n->val.str) return -EINVAL; n->re = calloc(1, sizeof(regex_t));