Re: Raw Payload Expressions - out of bounds write?

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Jan 28, 2025 at 01:37:06AM +0100, Florian Westphal wrote:
> Sunny73Cr <Sunny73Cr@protonmail.com> wrote:
> > > Please elaborate as what is wrong here in listing 3.
> > 
> > Within the second line of the rule (@ih,80,16 set @ih,80,16 & 0x3f0 \)
> > 
> > The mask 0x3f0 equates to 1,008 in decimal.
> > (3 * 16**2) + (15 * 16**1) + (0 * 16^0) = 1,008
> > Here '**' indicates exponent.
> > 
> > 1,008 is far larger than the 34 bit range that I covered.
> 
> Sigh.  Why did you not say something like:
> 
> The mask is provided as '0x3f0' in the listing, but I had expected
> 0xfc0f, as only 6 bits should be cleared, but the mask KEEPS 6 bits.
> 
> It would have saved me a headache figuring out bug you refer to.
> I am not a mind reader :-/
> 
> Use --debug=netlink, it looks like its a display bug.
> 
> I'll have a look.

It looks like netlink_delinearize is missing code to compact the
expression.