Bug 1995473

Summary:	Call xtables_malloc() in mnl_err_list_node_add()
Product:	Red Hat Enterprise Linux 9	Reporter:	Phil Sutter <psutter>
Component:	iptables	Assignee:	Phil Sutter <psutter>
Status:	CLOSED ERRATA	QA Contact:	qe-baseos-daemons
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	todoleza
Target Milestone:	beta	Keywords:	Triaged, Upstream
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	iptables-1.8.7-25.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 15:52:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Phil Sutter 2021-08-19 08:41:51 UTC

Coverity tool detected this snippet:

| struct mnl_err *err = malloc(sizeof(struct mnl_err));
| 
| err->seqnum = seqnum;

Calling xtables_malloc() instead makes the program exit(1) instead of crashing if memory allocation fails.

Comment 1 Phil Sutter 2021-08-31 16:23:49 UTC

Upstream commit to backport:

commit ca11c7b7036b5821c17b8d08dc2a29f55b461a93
Author: Phil Sutter <phil>
Date:   Tue Aug 31 12:26:20 2021 +0200

    nft: Use xtables_malloc() in mnl_err_list_node_add()
    
    The function called malloc() without checking for memory allocation
    failure. Simply replace the call by xtables_malloc() to fix that.
    
    Fixes: 4e2020952d6f9 ("xtables: use libnftnl batch API")
    Signed-off-by: Phil Sutter <phil>

Comment 3 Phil Sutter 2021-10-07 16:23:37 UTC

https://gitlab.com/redhat/centos-stream/rpms/iptables/-/merge_requests/21

Comment 11 errata-xmlrpc 2022-05-17 15:52:12 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: iptables), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:3936