diff options
| author | Gurucharan Shetty <gshetty@nicira.com> | 2013-03-22 16:25:36 -0700 |
|---|---|---|
| committer | Gurucharan Shetty <gshetty@nicira.com> | 2013-03-24 18:07:54 -0700 |
| commit | 3383887a349c1227867c2a00d188bb8c4a53194a (patch) | |
| tree | e1db95ef5251c66daa02682ac589e4510fae1060 /lib | |
| parent | 7cd875dbc82730c5c308ec05822a8b8d444c8a2f (diff) | |
odp-utils: Fix memory corruption while flow parsing.
Currently, when flow attribute type is greater than OVS_KEY_ATTR_MAX,
we can write into a random memory address causing corruption. Fix it.
Bug #15702.
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/odp-util.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/odp-util.c b/lib/odp-util.c index 19d3b7d3..120ab1da 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -1623,6 +1623,7 @@ parse_flow_nlattrs(const struct nlattr *key, size_t key_len, uint64_t present_attrs; size_t left; + BUILD_ASSERT(OVS_KEY_ATTR_MAX < CHAR_BIT * sizeof present_attrs); present_attrs = 0; *out_of_range_attrp = 0; NL_ATTR_FOR_EACH (nla, left, key, key_len) { @@ -1637,7 +1638,7 @@ parse_flow_nlattrs(const struct nlattr *key, size_t key_len, return false; } - if (type >= CHAR_BIT * sizeof present_attrs) { + if (type > OVS_KEY_ATTR_MAX) { *out_of_range_attrp = type; } else { if (present_attrs & (UINT64_C(1) << type)) { |