From fb97a0fa7d9ada9ab2f54bcf97cff8637e3043d6 Mon Sep 17 00:00:00 2001 From: Prashant Kumar Singh Date: Fri, 23 Oct 2026 09:20:54 -0700 Subject: [PATCH] lib: allocate matchers and set elements with calloc() Matcher payloads and set elements are parsed into buffers allocated with malloc(), and nothing guarantees a parser writes every byte. _bf_parse_ipv6_net() leaves the 4 bytes of padding at the end of struct bf_ip6_lpm_key unset, so an ip6.snet or ip6.dnet element parsed from text keeps whatever was in that memory. Set elements are compared byte for byte, so "chain update-set --remove" of such a prefix doesn't find it and still returns success, the prefix keeps matching, and the same prefix can be stored several times in one set. Allocate matchers and set elements with calloc(), so the bytes a parser doesn't write are zero. --- src/libbpfilter/matcher.c | 4 ++-- src/libbpfilter/set.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/libbpfilter/matcher.c b/src/libbpfilter/matcher.c index 45568b31..3fee0f11 100644 --- a/src/libbpfilter/matcher.c +++ b/src/libbpfilter/matcher.c @@ -1378,7 +1378,7 @@ static int _bf_matcher_new(struct bf_matcher **matcher, if (payload_len > SIZE_MAX - sizeof(*_matcher)) return -E2BIG; - _matcher = malloc(sizeof(struct bf_matcher) + payload_len); + _matcher = calloc(1, sizeof(struct bf_matcher) + payload_len); if (!_matcher) return -ENOMEM; @@ -1429,7 +1429,7 @@ int bf_matcher_new_from_raw(struct bf_matcher **matcher, bf_matcher_type_to_str(type), bf_matcher_op_to_str(op)); } - _matcher = malloc(sizeof(*_matcher) + ops->ref_payload_size); + _matcher = calloc(1, sizeof(*_matcher) + ops->ref_payload_size); if (!_matcher) return -ENOMEM; diff --git a/src/libbpfilter/set.c b/src/libbpfilter/set.c index a0b01c45..e2992a8e 100644 --- a/src/libbpfilter/set.c +++ b/src/libbpfilter/set.c @@ -323,7 +323,7 @@ int bf_set_add_elem_raw(struct bf_set *set, const char *raw_elem) raw_elem); } - elem = malloc(set->elem_size); + elem = calloc(1, set->elem_size); if (!elem) return bf_err_r(-ENOMEM, "failed to allocate a new set element");