evaluate: don't crash if range has same start and end interval

In this case, evaluation step replaces the range expression with a
single value and we'd crash as range->left/right contain garbage
values.

Simply replace the input expression with the evaluation result.

Also add a test case modeled on the afl reproducer.

Fixes: fe6cc0ad29cd ("evaluate: consolidate evaluation of symbol range expression")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 5 insertions, 0 deletions

diff --git a/src/evaluate.c b/src/evaluate.c
index e27d08ce..722c11a2 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2351,6 +2351,10 @@ static int expr_evaluate_symbol_range(struct eval_ctx *ctx, struct expr **exprp)
 		expr_free(range);
 		return -1;
 	}
+
+	if (range->etype != EXPR_RANGE)
+		goto out_done;
+
 	left = range->left;
 	right = range->right;
 
@@ -2371,6 +2375,7 @@ static int expr_evaluate_symbol_range(struct eval_ctx *ctx, struct expr **exprp)
 		return 0;
 	}
 
+out_done:
 	expr_free(expr);
 	*exprp = range;