Skip to content

Commit

Permalink
odp-util: Stop parse odp actions if nlattr is overflow
Browse files Browse the repository at this point in the history
`encap = nl_msg_start_nested(key, OVS_KEY_ATTR_ENCAP)` ensures that
key->size >= (encap + NLA_HDRLEN), so the `if` statement is safe.

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11306
Signed-off-by: Yifeng Sun <pkusunyifeng@gmail.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>
  • Loading branch information
yifsun authored and blp committed Feb 4, 2019
1 parent 1234d2f commit 2348930
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions lib/odp-util.c
Expand Up @@ -2318,6 +2318,10 @@ parse_odp_key_mask_attr(const char *s, const struct simap *port_names,
if (retval < 0) {
return retval;
}

if (nl_attr_oversized(key->size - encap - NLA_HDRLEN)) {
return -E2BIG;
}
s += retval;
}
s++;
Expand Down

0 comments on commit 2348930

Please sign in to comment.