fw4: fix skipping invalid IPv6 ipset entries

The current code did not account for invalid IPv6 entries yielding `null`
after subnet parsing, leading to an incorrect warning about multiple entries
and a subsequent `null` access leading to a crash.

Fix the issue by ensuring that the length check expression yields `0` on
invalid inputs.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/root/usr/share/ucode/fw4.uc b/root/usr/share/ucode/fw4.uc
index 0200758286fe1eb1e109282d3a070655040adafe..d600528c80cee92d4cb818cc7f856a265a4516f2 100644 (file)
--- a/root/usr/share/ucode/fw4.uc
+++ b/root/usr/share/ucode/fw4.uc
@@ -1439,7 +1439,7 @@ return {
                        case 'ipv6_addr':
                                ip = filter(this.parse_subnet(values[i]), a => (a.family == 6));
 
-                               switch(length(ip)) {
+                               switch (length(ip) ?? 0) {
                                case 0: return null;
                                case 1: break;
                                case 2: this.warn("Set entry '%s' resolves to multiple addresses, using first one", values[i]);