From 59239ade08feeb6abe45304632d6349eefabb5bf Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 30 Jun 2026 14:31:01 +0200 Subject: [PATCH] evaluate: validate set expression type before accessing flags JIRA: https://issues.redhat.com/browse/RHEL-190549 Upstream Status: nftables commit 2022e8bb5cf0e0fa81ab0a5087bd1ab6e20280ee commit 2022e8bb5cf0e0fa81ab0a5087bd1ab6e20280ee Author: Pablo Neira Ayuso Date: Wed Jul 9 00:21:49 2025 +0200 evaluate: validate set expression type before accessing flags Validate set->init is of EXPR_SET expression type before accessing set_flags. Fixes: 81e36530fcac ("src: replace interval segment tree overlap and automerge") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Phil Sutter --- src/evaluate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/evaluate.c b/src/evaluate.c index 711990a..5012dd2 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -4715,7 +4715,8 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set) set->flags |= NFT_SET_EXPR; if (set_is_anonymous(set->flags)) { - if (set_is_interval(set->init->set_flags) && + if (set->init->etype == EXPR_SET && + set_is_interval(set->init->set_flags) && !(set->init->set_flags & NFT_SET_CONCAT) && interval_set_eval(ctx, set, set->init) < 0) return -1;