Re: [PATCH nft] evaluate: fix crash if we add an error format rule

[Florian Westphal <fw@strlen.de>]

Liping Zhang <zlpnobody@163.com> wrote:
> If we add a such nft rule:
>   nft add rule filter input ip protocol icmp tcp dport 0
> 
> we will always meet the assert condition:
>   nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed.
>   Aborted (core dumped)
> ---
>  src/evaluate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/evaluate.c b/src/evaluate.c
> index 53f19b2..c317761 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx,
>  		list_add_tail(&nstmt->list, &ctx->stmt->list);
>  	}
>  
> -	assert(base < PROTO_BASE_MAX);
> +	assert(base <= PROTO_BASE_MAX);

Right, BASE_MAX is in fact the transport header base.

Applied, thanks!