payload: assert when accessing inner transport header

Instead of segfaulting due to out of bound access access to protocol
context array ctx->protocol[base].location from proto_ctx_update().

 # nft add rule filter input ah nexthdr tcp
 nft: payload.c:88: payload_expr_pctx_update: Assertion `left->payload.base + 1 <= (__PROTO_BASE_MAX - 1)' failed.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/payload.c b/src/payload.c
index 83742fb079fb021b10d0ca828d4342f9890d232e..08578fd86b22eb40d36910a7604751b193959ba2 100644 (file)
--- a/src/payload.c
+++ b/src/payload.c
@@ -85,6 +85,7 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
        base = ctx->protocol[left->payload.base].desc;
        desc = proto_find_upper(base, proto);
 
+       assert(left->payload.base + 1 <= PROTO_BASE_MAX);
        proto_ctx_update(ctx, left->payload.base + 1, &expr->location, desc);
 }