From: Florian Westphal Date: Thu, 14 Dec 2023 08:39:13 +0000 (+0100) Subject: evaluate: fix gmp assertion with too-large reject code X-Git-Tag: v1.0.6.1~274 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=46242174ca49fa298fe750ba14a384aa634eb030;p=thirdparty%2Fnftables.git evaluate: fix gmp assertion with too-large reject code commit 060ed8655d64874a92e6fba2ba9452b2aa94849e upstream. Before: nft: gmputil.c:77: mpz_get_uint8: Assertion `cnt <= 1' failed. After: Error: reject code must be integer in range 0-255 Signed-off-by: Florian Westphal --- diff --git a/src/evaluate.c b/src/evaluate.c index 12f57976..e16f8f62 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -3412,6 +3412,13 @@ static int stmt_evaluate_reject_icmp(struct eval_ctx *ctx, struct stmt *stmt) erec_queue(erec, ctx->msgs); return -1; } + + if (mpz_cmp_ui(code->value, UINT8_MAX) > 0) { + expr_free(code); + return expr_error(ctx->msgs, stmt->reject.expr, + "reject code must be integer in range 0-255"); + } + stmt->reject.icmp_code = mpz_get_uint8(code->value); expr_free(code); diff --git a/tests/shell/testcases/bogons/nft-f/icmp_reject_type_uint8_assert b/tests/shell/testcases/bogons/nft-f/icmp_reject_type_uint8_assert new file mode 100644 index 00000000..1fc85b29 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/icmp_reject_type_uint8_assert @@ -0,0 +1 @@ +rule t c reject with icmp 512