[Bug 1391] New: iptables-nft-restore --test can segfault

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1391

            Bug ID: 1391
           Summary: iptables-nft-restore --test can segfault
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: Gentoo
            Status: NEW
          Severity: normal
          Priority: P5
         Component: iptables over nftable
          Assignee: pablo at netfilter.org
          Reporter: kfm at plushkava.net

Upon first ever using iptables-nft-restore to test a long-standing production
ruleset, I encountered a segmentation fault. I have been able to reduce it to
this test case:

# printf '%s\nCOMMIT\n' '*nat' '*raw' '*filter' | iptables-nft-restore --test

Omitting the --test option prevents the segfault from occurring.

Currently, I am testing with a Gentoo Linux system that uses the following
components:

Linux 5.4.5
glibc-2.29
iptables-1.8.4
libmnl-1.0.4
libnfnetlink-1.0.1
libnftnl-1.1.5

Some additional details have been shared with Pablo via private correspondence.
I shall post them here, if requested.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20191222/e814dfd8/attachment.html>