From 0a8635183edd097916937cc7de5a29fbea9b8d2a Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Mon, 28 May 2018 22:17:50 +0200 Subject: xtables-compat: ignore '+' interface name its same as omitting it, so instead of generating invalid compare-with-0-sized-register, just ignore it. Reported-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal --- iptables/nft-shared.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index 1d9554d3..b89a3e7b 100644 --- a/iptables/nft-shared.c +++ b/iptables/nft-shared.c @@ -139,9 +139,10 @@ void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op) iface_len = strlen(iface); add_meta(r, NFT_META_IIFNAME); - if (iface[iface_len - 1] == '+') - add_cmp_ptr(r, op, iface, iface_len - 1); - else + if (iface[iface_len - 1] == '+') { + if (iface_len > 1) + add_cmp_ptr(r, op, iface, iface_len - 1); + } else add_cmp_ptr(r, op, iface, iface_len + 1); } @@ -152,9 +153,10 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op) iface_len = strlen(iface); add_meta(r, NFT_META_OIFNAME); - if (iface[iface_len - 1] == '+') - add_cmp_ptr(r, op, iface, iface_len - 1); - else + if (iface[iface_len - 1] == '+') { + if (iface_len > 1) + add_cmp_ptr(r, op, iface, iface_len - 1); + } else add_cmp_ptr(r, op, iface, iface_len + 1); } -- cgit v1.2.3