diff options
| author | Florian Westphal <fw@strlen.de> | 2023-12-01 14:16:14 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-12-03 12:33:16 +0100 |
| commit | 26723202e600604ab7cf48915507cfcb7a313620 (patch) | |
| tree | 2bd8e652f6be46b3b50b8a1c895449e8f71434ee /src/evaluate.c | |
| parent | c9c2f54c6fb8f9303372202eab5b3e00088c7577 (diff) | |
evaluate: prevent assert when evaluating very large shift values
Error out instead of 'nft: gmputil.c:67: mpz_get_uint32: Assertion `cnt <= 1' failed.'.
Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand")
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/evaluate.c')
| -rw-r--r-- | src/evaluate.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 048880e5..e4dc5f65 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1312,9 +1312,14 @@ static int constant_binop_simplify(struct eval_ctx *ctx, struct expr **expr) static int expr_evaluate_shift(struct eval_ctx *ctx, struct expr **expr) { struct expr *op = *expr, *left = op->left, *right = op->right; - unsigned int shift = mpz_get_uint32(right->value); - unsigned int max_shift_len; + unsigned int shift, max_shift_len; + /* mpz_get_uint32 has assert() for huge values */ + if (mpz_cmp_ui(right->value, UINT_MAX) > 0) + return expr_binary_error(ctx->msgs, right, left, + "shifts exceeding %u bits are not supported", UINT_MAX); + + shift = mpz_get_uint32(right->value); if (ctx->stmt_len > left->len) max_shift_len = ctx->stmt_len; else |