On 20/08/22 9:56 pm, Florian Westphal wrote:

Harshit Mogalapalli [off-list ref] wrote:

quoted

In ebt_do_table() function dereferencing 'private->hook_entry[hook]'
can lead to NULL pointer dereference. So add a check to prevent that.

Hi Florian,

Thanks a lot for checking the patch.

This looks incorrect, i.e. paperimg over the problem.

Okay.

If hook_entry[hook] is NULL, how did this make it to the eval loop?

When I run the reproducer and have 'private->hook_entry[hook]' printed, 
it was NULL, so thought of adding a NULL check to prevent the NULL 
dereference.

Attaching the C reproducer.

Regards,
Harshit

I guess ebtables lacks a sanity check on incoming ruleset?