51 lines
2.1 KiB
Diff
51 lines
2.1 KiB
Diff
From 1bfcf1e3dbd322525bb227733e0e04c9f0389d01 Mon Sep 17 00:00:00 2001
|
|
From: Phil Sutter <psutter@redhat.com>
|
|
Date: Tue, 28 Jul 2026 13:31:25 +0200
|
|
Subject: [PATCH] parser_json: fix map/set type confusion crash in map
|
|
statement parser
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-179035
|
|
Upstream Status: nftables commit 628701e796ab9a4da5541cf77fa809c2ce8e7720
|
|
|
|
commit 628701e796ab9a4da5541cf77fa809c2ce8e7720
|
|
Author: Florian Westphal <fw@strlen.de>
|
|
Date: Thu May 21 16:18:55 2026 +0200
|
|
|
|
parser_json: fix map/set type confusion crash in map statement parser
|
|
|
|
Quoting Alessandro Gario:
|
|
Anthropic is conducting research into the use of large language models
|
|
for automated vulnerability discovery in open source software. As part
|
|
of that work, Anthropic used Claude to scan a set of widely used open
|
|
source projects for security issues. Anthropic then engaged Trail of
|
|
Bits to independently triage, manually validate, and develop patches
|
|
for the findings. [..]
|
|
|
|
json_parse_map_stmt() in src/parser_json.c:2584 passes
|
|
&stmt->set.stmt_list to json_parse_set_stmt_list(), but the
|
|
statement object is a map_stmt. The function reads as a copy/edit of
|
|
json_parse_set_stmt() that forgot to retarget the list-head pointer.
|
|
|
|
Reported-by: Alessandro Gario <alessandro.gario@trailofbits.com>
|
|
Fixes: 27a2da23d508 ("netlink_linearize: skip set element expression in map statement key")
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
---
|
|
src/parser_json.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/parser_json.c b/src/parser_json.c
|
|
index 3a50c86..3521885 100644
|
|
--- a/src/parser_json.c
|
|
+++ b/src/parser_json.c
|
|
@@ -2532,7 +2532,7 @@ static struct stmt *json_parse_map_stmt(struct json_ctx *ctx,
|
|
stmt->map.set = expr2;
|
|
|
|
if (!json_unpack(value, "{s:o}", "stmt", &stmt_json) &&
|
|
- json_parse_set_stmt_list(ctx, &stmt->set.stmt_list, stmt_json) < 0) {
|
|
+ json_parse_set_stmt_list(ctx, &stmt->map.stmt_list, stmt_json) < 0) {
|
|
stmt_free(stmt);
|
|
return NULL;
|
|
}
|