* [PATCH libnftnl] expr: immediate: fix leak in expression destroy path
@ 2015-08-18 0:04 Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2015-08-18 0:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
The verdict can be a chain string, make sure we release it when the expression
is destroyed. This patch adds a new nft_free_data() for this purpose and use it
from the immediate expression.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/data_reg.h | 1 +
src/expr/data_reg.c | 11 +++++++++++
src/expr/immediate.c | 9 +++++++++
3 files changed, 21 insertions(+)
diff --git a/include/data_reg.h b/include/data_reg.h
index cf14988..e0fdd10 100644
--- a/include/data_reg.h
+++ b/include/data_reg.h
@@ -28,5 +28,6 @@ int nft_data_reg_snprintf(char *buf, size_t size, union nft_data_reg *reg,
struct nlattr;
int nft_parse_data(union nft_data_reg *data, struct nlattr *attr, int *type);
+void nft_free_verdict(union nft_data_reg *data);
#endif
diff --git a/src/expr/data_reg.c b/src/expr/data_reg.c
index b5fbdf2..b375db4 100644
--- a/src/expr/data_reg.c
+++ b/src/expr/data_reg.c
@@ -499,3 +499,14 @@ int nft_parse_data(union nft_data_reg *data, struct nlattr *attr, int *type)
return ret;
}
+void nft_free_verdict(union nft_data_reg *data)
+{
+ switch(data->verdict) {
+ case NFT_JUMP:
+ case NFT_GOTO:
+ xfree(data->chain);
+ break;
+ default:
+ break;
+ }
+}
diff --git a/src/expr/immediate.c b/src/expr/immediate.c
index 692d9e9..cf06190 100644
--- a/src/expr/immediate.c
+++ b/src/expr/immediate.c
@@ -309,10 +309,19 @@ nft_rule_expr_immediate_snprintf(char *buf, size_t len, uint32_t type,
return -1;
}
+static void nft_rule_expr_immediate_free(struct nft_rule_expr *e)
+{
+ struct nft_expr_immediate *imm = nft_expr_data(e);
+
+ if (e->flags & (1 << NFT_EXPR_IMM_VERDICT))
+ nft_free_verdict(&imm->data);
+}
+
struct expr_ops expr_ops_immediate = {
.name = "immediate",
.alloc_len = sizeof(struct nft_expr_immediate),
.max_attr = NFTA_IMMEDIATE_MAX,
+ .free = nft_rule_expr_immediate_free,
.set = nft_rule_expr_immediate_set,
.get = nft_rule_expr_immediate_get,
.parse = nft_rule_expr_immediate_parse,
--
1.7.10.4
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-08-17 23:58 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-08-18 0:04 [PATCH libnftnl] expr: immediate: fix leak in expression destroy path Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).