mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-31 14:25:26 +00:00
Code Issues Releases Wiki Activity

odp-util: Use flexible sized buffer to hold Geneve options.

Browse Source 
The 'mask' buffer in parse_odp_action() is supposed to always be big
enough:
        /* 'mask' is big enough to hold any key. */

Geneve options can be really big and the comment was wrong.  In addition,
the user might supply more options than can really fit in any case, so
we might as well just use a stub.

Found by libfuzzer.

Reported-by: Bhargava Shastry <bshastry@sec.t-labs.tu-berlin.de>
Signed-off-by: Ben Pfaff <blp@ovn.org>
This commit is contained in:
Ben Pfaff
2017-12-04 11:51:43 -08:00
parent 40f583684f
commit c34a5515e2
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
lib/odp-util.c
View File

@@ -1965,20 +1965,19 @@ parse_odp_action(const char *s, const struct simap *port_names,
if (!strncmp(s, "set(", 4)) {
size_t start_ofs;
int retval;
struct nlattr mask[128 / sizeof(struct nlattr)];
struct ofpbuf maskbuf;
struct nlattr mask[1024 / sizeof(struct nlattr)];
struct ofpbuf maskbuf = OFPBUF_STUB_INITIALIZER(mask);
struct nlattr *nested, *key;
size_t size;
/* 'mask' is big enough to hold any key. */
ofpbuf_use_stack(&maskbuf, mask, sizeof mask);
start_ofs = nl_msg_start_nested(actions, OVS_ACTION_ATTR_SET);
retval = parse_odp_key_mask_attr(s + 4, port_names, actions, &maskbuf);
if (retval < 0) {
ofpbuf_uninit(&maskbuf);
return retval;
}
if (s[retval + 4] != ')') {
ofpbuf_uninit(&maskbuf);
return -EINVAL;
}
@@ -2005,6 +2004,7 @@ parse_odp_action(const char *s, const struct simap *port_names,
nested->nla_type = OVS_ACTION_ATTR_SET_MASKED;
}
}
ofpbuf_uninit(&maskbuf);
nl_msg_end_nested(actions, start_ofs);
return retval + 5;