evaluate: fix gmp assertion with too-large reject code

commit 060ed8655d64874a92e6fba2ba9452b2aa94849e upstream.

Before:
nft: gmputil.c:77: mpz_get_uint8: Assertion `cnt <= 1' failed.
After: Error: reject code must be integer in range 0-255

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/evaluate.c b/src/evaluate.c
index 12f579768413766acbdb2c8d8bea89b741009974..e16f8f620df251dbd05688a6b34df4b3f4b5ec52 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3412,6 +3412,13 @@ static int stmt_evaluate_reject_icmp(struct eval_ctx *ctx, struct stmt *stmt)
                erec_queue(erec, ctx->msgs);
                return -1;
        }
+
+       if (mpz_cmp_ui(code->value, UINT8_MAX) > 0) {
+               expr_free(code);
+               return expr_error(ctx->msgs, stmt->reject.expr,
+                                 "reject code must be integer in range 0-255");
+       }
+
        stmt->reject.icmp_code = mpz_get_uint8(code->value);
        expr_free(code);
 

diff --git a/tests/shell/testcases/bogons/nft-f/icmp_reject_type_uint8_assert b/tests/shell/testcases/bogons/nft-f/icmp_reject_type_uint8_assert
new file mode 100644 (file)
index 0000000..1fc85b2
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-f/icmp_reject_type_uint8_assert
@@ -0,0 +1 @@
+rule t c reject with icmp 512