]> git.ipfire.org Git - thirdparty/nftables.git/commit
evaluate: error out when store needs more than one 128bit register of align fixup
authorFlorian Westphal <fw@strlen.de>
Mon, 15 Jan 2024 13:11:17 +0000 (14:11 +0100)
committerFlorian Westphal <fw@strlen.de>
Mon, 15 Jan 2024 13:21:53 +0000 (14:21 +0100)
commit8a66de2a15943b2fbf960967cdbcbd0a148cb114
tree1d919baf5225a0b29b1d21aa95a2148ede3eceb1
parente08627257ecfa7dfb68a34a1c8866e7a7e012b15
evaluate: error out when store needs more than one 128bit register of align fixup

Else this gives:
nft: evaluate.c:2983: stmt_evaluate_payload: Assertion `sizeof(data) * BITS_PER_BYTE >= masklen' failed.

For loads, this is already prevented via expr_evaluate_bits() which has:

  if (masklen > NFT_REG_SIZE * BITS_PER_BYTE)
      return expr_error(ctx->msgs, expr, "mask length %u exceeds allowed maximum of %u\n",
                        masklen, NFT_REG_SIZE * BITS_PER_BYTE);

But for the store path this isn't called.
The reproducer asks to store a 128 bit integer at bit offset 1, i.e.
17 bytes would need to be munged, but we can only handle up to 16 bytes
(one pseudo-register).

Fixes: 78936d50f306 ("evaluate: add support to set IPv6 non-byte header fields")
Signed-off-by: Florian Westphal <fw@strlen.de>
src/evaluate.c
tests/shell/testcases/bogons/nft-f/payload_expr_unaligned_store [new file with mode: 0644]