Re: [PATCH] netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook()

[Florian Westphal <fw@xxxxxxxxx>]

Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> 	if (hook->num > 31 || !(type->hook_mask & (1 << hook->num)))
> 
> which seems like a slightly ugly magic number but it fixes the buffer
> overflow.

You can use NF_MAX_HOOKS instead of 31.