提交 8bea728d 编写于 作者: H Hangbin Liu 提交者: Pablo Neira Ayuso

netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()

If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in
nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done(),
we need to check if filter is NULL first.

Fixes: e46abbcc ("netfilter: nf_tables: Allow table names of up to 255 chars")
Signed-off-by: NHangbin Liu <liuhangbin@gmail.com>
Acked-by: NPhil Sutter <phil@nwl.cc>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
上级 4c82fd0a
......@@ -4665,8 +4665,10 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)
{
struct nft_obj_filter *filter = cb->data;
kfree(filter->table);
kfree(filter);
if (filter) {
kfree(filter->table);
kfree(filter);
}
return 0;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册