extensions: libxt_connlabel: fix crash when connlabel.conf is empty

When connlabel.conf is empty, nfct_labelmap_new will return NULL and
set errno to 0. So we will miss to check this situation, and cause NULL
deference in nfct_labelmap_get_bit.

Input the following commands will reproduce this crash:
  # echo > /etc/xtables/connlabel.conf
  # iptables -A INPUT -m connlabel --label abc
  Segmentation fault (core dumped)

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
index 1f830954d4843a48c9b29c430820eeb653b8ad3e..355c99ae78f9045454a46fb6e7e2500118973394 100644 (file)
--- a/extensions/libxt_connlabel.c
+++ b/extensions/libxt_connlabel.c
@@ -38,9 +38,16 @@ static void connlabel_open(void)
                return;
 
        map = nfct_labelmap_new(NULL);
-       if (!map && errno)
-               xtables_error(RESOURCE_PROBLEM, "cannot open connlabel.conf: %s\n",
-                       strerror(errno));
+       if (map != NULL)
+               return;
+
+       if (errno) {
+               xtables_error(RESOURCE_PROBLEM,
+                       "cannot open connlabel.conf: %s", strerror(errno));
+       } else {
+               xtables_error(RESOURCE_PROBLEM,
+                       "cannot parse label, maybe valid label map is empty");
+       }
 }
 
 static void connlabel_mt_parse(struct xt_option_call *cb)