Re: [nft PATCH v2 1/4] evaluate: Fix datalen checks in expr_evaluate_string()

2016-09-05 Thread Pablo Neira Ayuso
On Tue, Aug 30, 2016 at 07:39:49PM +0200, Phil Sutter wrote: > I have been told that the flex scanner won't return empty strings, so > strlen(data) should always be greater 0. To avoid a hard to debug issue > though, add an assert() to make sure this is always the case before > risking an unsigned

[nft PATCH v2 1/4] evaluate: Fix datalen checks in expr_evaluate_string()

2016-08-30 Thread Phil Sutter
I have been told that the flex scanner won't return empty strings, so strlen(data) should always be greater 0. To avoid a hard to debug issue though, add an assert() to make sure this is always the case before risking an unsigned variable underrun. A real issue though is the check for 'datalen - 1