mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-09-05 08:45:23 +00:00
Code Issues Releases Wiki Activity

learn: Avoid 1-byte buffer underrun in learn_format().

Browse Source 
Reported-and-tested-by: Jari Sundell <sundell.software@gmail.com>
This commit is contained in:
Ben Pfaff
2011-12-01 08:33:55 -08:00
parent a206a8c625
commit f299fbeb4b
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
lib/learn.c
View File

@@ -621,6 +621,17 @@ learn_format(const struct nx_action_learn *learn, struct ds *s)
union mf_value value;
uint8_t *bytes = (uint8_t *) &value;
if (src_value_bytes > dst_field->n_bytes) {
/* The destination field is an odd number of bytes, which
* got rounded up to a multiple of 2 to be put into the
* learning action. Skip over the leading byte, which
* should be zero anyway. Otherwise the memcpy() below
* will overrun the start of 'value'. */
int diff = src_value_bytes - dst_field->n_bytes;
src_value += diff;
src_value_bytes -= diff;
}
memset(&value, 0, sizeof value);
memcpy(&bytes[dst_field->n_bytes - src_value_bytes],
src_value, src_value_bytes);