Re: [PATCH] netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook()

[Florian Westphal]

Dan Carpenter <dan.carpen...@oracle.com> wrote:
>       if (hook->num > 31 || !(type->hook_mask & (1 << hook->num)))
> 
> which seems like a slightly ugly magic number but it fixes the buffer
> overflow.

You can use NF_MAX_HOOKS instead of 31.