From d4b86b6bfdf979a13c7cf4231bb4ec1d0c04d6a3 Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Sat, 14 May 2016 20:43:35 +0800 Subject: evaluate: fix crash if we add an error format rule If we add a such nft rule: nft add rule filter input ip protocol icmp tcp dport 0 we will always meet the assert condition: nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed. Aborted (core dumped) Signed-off-by: Florian Westphal --- src/evaluate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/evaluate.c b/src/evaluate.c index 53f19b29..c317761f 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -533,7 +533,7 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx, list_add_tail(&nstmt->list, &ctx->stmt->list); } - assert(base < PROTO_BASE_MAX); + assert(base <= PROTO_BASE_MAX); /* This payload and the existing context don't match, conflict. */ if (ctx->pctx.protocol[base + 1].desc != NULL) return 1; -- cgit v1.2.3