[PATCH nft] evaluate: fix crash when set name is null

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Bogon provides a handle but not a name.

Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
 src/cache.c                                            | 3 +++
 src/evaluate.c                                         | 3 +++
 tests/shell/testcases/bogons/nft-f/null_set_name_crash | 2 ++
 3 files changed, 8 insertions(+)
 create mode 100644 tests/shell/testcases/bogons/nft-f/null_set_name_crash

diff --git a/src/cache.c b/src/cache.c
index 3ac819cf68fb..67ba35bee1fa 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -840,6 +840,9 @@ struct set *set_cache_find(const struct table *table, const char *name)
 	struct set *set;
 	uint32_t hash;
 
+	if (!name)
+		return NULL;
+
 	hash = djb_hash(name) % NFT_CACHE_HSIZE;
 	list_for_each_entry(set, &table->set_cache.ht[hash], cache.hlist) {
 		if (!strcmp(set->handle.set.name, name))
diff --git a/src/evaluate.c b/src/evaluate.c
index 9c7f23cb080e..e8e4aa2df4ca 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -284,6 +284,9 @@ static int set_not_found(struct eval_ctx *ctx, const struct location *loc,
 	const struct table *table;
 	struct set *set;
 
+	if (!set_name)
+		set_name = "";
+
 	set = set_lookup_fuzzy(set_name, &ctx->nft->cache, &table);
 	if (set == NULL)
 		return cmd_error(ctx, loc, "%s", strerror(ENOENT));
diff --git a/tests/shell/testcases/bogons/nft-f/null_set_name_crash b/tests/shell/testcases/bogons/nft-f/null_set_name_crash
new file mode 100644
index 000000000000..e5d85b228a84
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-f/null_set_name_crash
@@ -0,0 +1,2 @@
+table y { }
+reset set y handle 6
-- 
2.49.0





[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux