From cdf08f27272798d63f52df017e26ac7f491fd1ce Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 25 Feb 2025 21:13:33 +0100 Subject: [PATCH] payload: return early if dependency is not a payload expression commit 50f45c004adbab6a077609088becf62d2651101f upstream. if (dep->left->payload.base != PROTO_BASE_TRANSPORT_HDR) is legal only after checking that ->left points to an EXPR_PAYLOAD expression. The dependency store can also contain EXPR_META, in this case we access a bogus part of the union. The payload_may_dependency_kill_icmp helper can't handle a META dep either, so return early. Fixes: 533565244d88 ("payload: check icmp dependency before removing previous icmp expression") Signed-off-by: Florian Westphal Reviewed-by: Pablo Neira Ayuso --- src/payload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/payload.c b/src/payload.c index 60c2cf2c..180bcab9 100644 --- a/src/payload.c +++ b/src/payload.c @@ -822,7 +822,8 @@ static bool payload_may_dependency_kill(struct payload_dep_ctx *ctx, if (expr->payload.base != PROTO_BASE_TRANSPORT_HDR) return true; - if (dep->left->payload.base != PROTO_BASE_TRANSPORT_HDR) + if (dep->left->etype != EXPR_PAYLOAD || + dep->left->payload.base != PROTO_BASE_TRANSPORT_HDR) return true; if (dep->left->payload.desc == &proto_icmp) -- 2.47.2