Skip to content

Conversation

@serpilliere
Copy link

Hi!
This PR fixes #15

The problem is that nfq_get_payload takes a pointer of pointer in parameters in order to return a pointer of the received packet.
The original code uses &*mut libc::c_void to describe this. This is not correct as the value of the pointer will be modified by nfq_get_payload. The correct declaration may be &mut *mut libc::c_void.

This code crashed in release mode due to the optimization made:

  • the pointer initialization is null
  • a reference on this pointer is given to nfq_get_payload, but as it's given as &, it notes that the pointer value cannot be changed.
  • when creating the slice from the pointer value, the optimization creates it using on a null pointer
  • (this can be seen if you disassemble the binary)

@ckcr4lyf
Copy link

Super interesting bug! Thanks for the investigation and fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Suspicious crash in release mode.

2 participants