Static analysis found a potential NULL pointer dereference in do_command_list() when handling CMD_OBJ_FLOWTABLE. If cmd->handle.table.name is not specified, the table pointer remains NULL after the cache lookup block. However, do_list_flowtable() expects a valid table pointer and dereferences it via ft_cache_find(). This is inconsistent with other object types (CMD_OBJ_SET, CMD_OBJ_CHAIN, etc.) which require a valid table for single-object listing. Add a NULL check before calling do_list_flowtable() to prevent the potential crash and return ENOENT error, consistent with existing error handling patterns. Signed-off-by: Anton Moryakov --- src/rule.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/rule.c b/src/rule.c index 8f8b77f1..0c3372ba 100644 --- a/src/rule.c +++ b/src/rule.c @@ -2655,6 +2655,10 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd) case CMD_OBJ_TUNNELS: return do_list_obj(ctx, cmd, NFT_OBJECT_TUNNEL); case CMD_OBJ_FLOWTABLE: + if (!table) { + errno = ENOENT; + return -1; + } return do_list_flowtable(ctx, cmd, table); case CMD_OBJ_FLOWTABLES: return do_list_flowtables(ctx, cmd); -- 2.39.2