a2ea441692
- Install an improved sample config - Fix permissions of osf-related configs - rule: Fix for potential off-by-one in cmd_add_loc() - netlink_delinearize: Fix suspicious calloc() call - netlink: Avoid memleak in error path of netlink_delinearize_obj() - netlink: Avoid memleak in error path of netlink_delinearize_table() - netlink: Avoid memleak in error path of netlink_delinearize_chain() - netlink: Avoid memleak in error path of netlink_delinearize_set() - json: Drop pointless assignment in exthdr_expr_json() - evaluate: Mark fall through case in str2hooknum() - parser_json: Fix for memleak in tcp option error path - parser_bison: Fix for implicit declaration of isalnum - main: fix nft --help output fallout from 719e4427 - tests: add icmp/6 test where dependency should be left alone - payload: check icmp dependency before removing previous icmp expression Resolves: rhbz#1933117, rhbz#1938823, rhbz#1931790, rhbz#1964987, rhbz#1971600
40 lines
1.2 KiB
Diff
40 lines
1.2 KiB
Diff
From a79e92c0f6761a748ef3cbffd26a4f1db82b4b3e Mon Sep 17 00:00:00 2001
|
|
From: Phil Sutter <phil@nwl.cc>
|
|
Date: Fri, 11 Jun 2021 16:07:02 +0200
|
|
Subject: [PATCH] parser_json: Fix for memleak in tcp option error path
|
|
|
|
If 'kind' value is invalid, the function returned without freeing 'expr'
|
|
first. Fix this by performing the check before allocation.
|
|
|
|
Fixes: cb21869649208 ("json: tcp: add raw tcp option match support")
|
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
(cherry picked from commit f7b0eef8391ae7f89a3a82f6eeecaebe199224d7)
|
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
---
|
|
src/parser_json.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/parser_json.c b/src/parser_json.c
|
|
index f0486b77a225a..85d05ce27eef3 100644
|
|
--- a/src/parser_json.c
|
|
+++ b/src/parser_json.c
|
|
@@ -611,12 +611,12 @@ static struct expr *json_parse_tcp_option_expr(struct json_ctx *ctx,
|
|
"base", &kind, "offset", &offset, "len", &len)) {
|
|
uint32_t flag = 0;
|
|
|
|
- expr = tcpopt_expr_alloc(int_loc, kind,
|
|
- TCPOPT_COMMON_KIND);
|
|
-
|
|
if (kind < 0 || kind > 255)
|
|
return NULL;
|
|
|
|
+ expr = tcpopt_expr_alloc(int_loc, kind,
|
|
+ TCPOPT_COMMON_KIND);
|
|
+
|
|
if (offset == TCPOPT_COMMON_KIND && len == 8)
|
|
flag = NFT_EXTHDR_F_PRESENT;
|
|
|
|
--
|
|
2.31.1
|
|
|