[Bug 1222] nft list ruleset – infinite memory use

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1222

--- Comment #2 from Pablo Neira Ayuso <pablo at netfilter.org> ---
For the record. This fixes the infinite loop.

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 2637f4baaec4..5ad3192a57aa 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -307,7 +307,7 @@ static void netlink_parse_lookup(struct netlink_parse_ctx
*ctx,
                return netlink_error(ctx, loc,
                                     "Lookup expression has no left hand
side");

-       if (left->len < set->key->len) {
+       if (left->len > 0 && left->len < set->key->len) {
                left = netlink_parse_concat_expr(ctx, loc, sreg,
set->key->len);
                if (left == NULL)
                        return;

However, this is still broken with ct saddr and concatenations.

Still considering here where to go with this bug report.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180201/0b050fd5/attachment.html>