From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 3 Apr 2018 11:00:31 +0000 (+0200)
Subject: evaluate: propagate binop_transfer() adjustment to set key size
X-Git-Tag: v0.8.4~51
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=715c8e7b625a48d3a64d9d2a7f83e33e458b1355;p=thirdparty%2Fnftables.git

evaluate: propagate binop_transfer() adjustment to set key size

The right shift transfer may be result in adjusting the set key size,
eg. ip6 dscp results in fetching 6 bits that are splitted between two
bytes, hence the set element ends up being 16 bytes long.

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/src/evaluate.c b/src/evaluate.c
index d6961099..967ad162 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1282,8 +1282,9 @@ static int expr_evaluate_map(struct eval_ctx *ctx, struct expr **expr)
 		if (binop_transfer(ctx, expr) < 0)
 			return -1;
 
-		map = *expr;
+		ctx->set->key->len = ctx->ectx.len;
 		ctx->set = NULL;
+		map = *expr;
 		map->mappings->set->flags |= map->mappings->set->init->set_flags;
 		break;
 	case EXPR_SYMBOL: