From 8b2bff4187d2b57ff3ed3986aadd84cff9753ebd Mon Sep 17 00:00:00 2001
From: bol-van <none@none.none>
Date: Wed, 11 Feb 2026 11:02:50 +0300
Subject: [PATCH] AI fixes

---
 lua/zapret-auto.lua  |  2 +-
 lua/zapret-tests.lua |  4 +---
 nfq2/lua.c           |  7 ++++---
 nfq2/sec.c           | 15 ++++++++++++---
 4 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/lua/zapret-auto.lua b/lua/zapret-auto.lua
index 769567d..9b7a4c2 100644
--- a/lua/zapret-auto.lua
+++ b/lua/zapret-auto.lua
@@ -477,7 +477,7 @@ function per_instance_condition(ctx, desync)
 		if not instance then break end
 		if instance.arg.cond then
 			if type(_G[instance.arg.cond])~="function" then
-				error(name..": invalid 'iff' function '"..instance.arg.cond.."'")
+				error("per_instance_condition: invalid 'iff' function '"..instance.arg.cond.."'")
 			end
 			if logical_xor(_G[instance.arg.cond](desync), instance.arg.cond_neg) then
 				verdict = plan_instance_execute(desync, verdict, instance)
diff --git a/lua/zapret-tests.lua b/lua/zapret-tests.lua
index 393d03a..ddda913 100644
--- a/lua/zapret-tests.lua
+++ b/lua/zapret-tests.lua
@@ -90,10 +90,9 @@ function test_hkdf()
 			local ikm = brandom(math.random(5,10))
 			for ninfo=1,nblob do
 				local info = brandom(math.random(5,10))
-				local okm_prev
 				for k,sha in pairs({"sha256","sha224"}) do
-					for k,okml in pairs({8, 16, 50}) do
 					local okm_prev
+					for k,okml in pairs({8, 16, 50}) do
 						local okm
 						print("* hkdf "..sha)
 						print("salt: "..string2hex(salt))
@@ -107,7 +106,6 @@ function test_hkdf()
 							print("duplicate okm !")
 						end
 						okms[okm] = true
-
 						test_assert(not okm_prev or okm_prev==string.sub(okm, 1, #okm_prev))
 						okm_prev = okm
 					end
diff --git a/nfq2/lua.c b/nfq2/lua.c
index 86758f8..728a488 100644
--- a/nfq2/lua.c
+++ b/nfq2/lua.c
@@ -2569,12 +2569,13 @@ bool lua_reconstruct_dissect(lua_State *L, int idx, uint8_t *buf, size_t *len, b
 					DLOG_ERR("ipv4 frag : invalid ip_len\n");
 					goto err;
 				}
-				if (frag_start>l)
+				size_t frag_len = iplen-l3;
+				if ((frag_start+frag_len)>l)
 				{
-					DLOG_ERR("ipv4 frag : fragment offset is outside of the packet\n");
+					DLOG_ERR("ipv4 frag : fragment end is outside of the packet\n");
 					goto err;
 				}
-				if (off) memmove(buf+l3,buf+l3+off,iplen-l3);
+				if (off) memmove(buf+l3,buf+frag_start,frag_len);
 				l = iplen; // shrink packet to iplen
 			}
 			else
diff --git a/nfq2/sec.c b/nfq2/sec.c
index 3a01cab..bd2df92 100644
--- a/nfq2/sec.c
+++ b/nfq2/sec.c
@@ -350,10 +350,19 @@ void daemonize(void)
 		DLOG_PERROR("setsid");
 		exit(21);
 	}
-	if (close(STDIN_FILENO)<0 || close(STDOUT_FILENO)<0 || close(STDERR_FILENO)<0)
+	if (close(STDIN_FILENO)<0 && errno!=EBADF)
 	{
-		// will work only if debug not to console
-		DLOG_PERROR("close");
+		DLOG_PERROR("close(stdin)");
+		exit(22);
+	}
+	if (close(STDOUT_FILENO)<0 && errno!=EBADF)
+	{
+		DLOG_PERROR("close(stdout)");
+		exit(22);
+	}
+	if (close(STDERR_FILENO)<0 && errno!=EBADF)
+	{
+		DLOG_PERROR("close(stderr)");
 		exit(22);
 	}
 	/* redirect fd's 0,1,2 to /dev/null */