Re: [PATCH] netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook()

Florian Westphal
2019-04-05T10:01:54Z

Dan Carpenter <dan.carpenter@oracle.com> wrote:
> if (hook->num > 31 || !(type->hook_mask & (1 << hook->num)))
>
> which seems like a slightly ugly magic number but it fixes the buffer
> overflow.

You can use NF_MAX_HOOKS instead of 31.