* [PATCH nft] evaluate: fix crash if we add an error format rule
@ 2016-05-14 12:43 Liping Zhang
2016-05-14 20:05 ` Florian Westphal
0 siblings, 1 reply; 2+ messages in thread
From: Liping Zhang @ 2016-05-14 12:43 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, Liping Zhang
From: Liping Zhang <liping.zhang@spreadtrum.com>
If we add a such nft rule:
nft add rule filter input ip protocol icmp tcp dport 0
we will always meet the assert condition:
nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed.
Aborted (core dumped)
---
src/evaluate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/evaluate.c b/src/evaluate.c
index 53f19b2..c317761 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx,
list_add_tail(&nstmt->list, &ctx->stmt->list);
}
- assert(base < PROTO_BASE_MAX);
+ assert(base <= PROTO_BASE_MAX);
/* This payload and the existing context don't match, conflict. */
if (ctx->pctx.protocol[base + 1].desc != NULL)
return 1;
--
2.5.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nft] evaluate: fix crash if we add an error format rule
2016-05-14 12:43 [PATCH nft] evaluate: fix crash if we add an error format rule Liping Zhang
@ 2016-05-14 20:05 ` Florian Westphal
0 siblings, 0 replies; 2+ messages in thread
From: Florian Westphal @ 2016-05-14 20:05 UTC (permalink / raw)
To: Liping Zhang; +Cc: pablo, netfilter-devel, Liping Zhang
Liping Zhang <zlpnobody@163.com> wrote:
> If we add a such nft rule:
> nft add rule filter input ip protocol icmp tcp dport 0
>
> we will always meet the assert condition:
> nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed.
> Aborted (core dumped)
> ---
> src/evaluate.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/evaluate.c b/src/evaluate.c
> index 53f19b2..c317761 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx,
> list_add_tail(&nstmt->list, &ctx->stmt->list);
> }
>
> - assert(base < PROTO_BASE_MAX);
> + assert(base <= PROTO_BASE_MAX);
Right, BASE_MAX is in fact the transport header base.
Applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-05-14 20:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-14 12:43 [PATCH nft] evaluate: fix crash if we add an error format rule Liping Zhang
2016-05-14 20:05 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).