Skip to content

Commit

Permalink
odp-util: Fix buffer overread in parsing string form of ODP flows.
Browse files Browse the repository at this point in the history
scan_u128() should return 0 on an error but it actually returned an errno
value in some cases, so a command like this:
    ovs-appctl dpctl/add-flow 'ct_label(1/55555555555555555555555555)' ''
could cause a buffer overread.

This bug is not as severe as it may sound because the string form of ODP
flows is not used over OpenFlow or OVSDB, only through the appctl interface
that is normally used just by local system administrators and not exposed
over a network.

Reported-by: Bhargava Shastry <bshastry@sec.t-labs.tu-berlin.de>
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Joe Stringer <joe@ovn.org>
  • Loading branch information
blp committed Nov 27, 2017
1 parent 221693b commit a99e918
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/odp-util.c
Expand Up @@ -3022,7 +3022,7 @@ scan_u128(const char *s_, ovs_u128 *value, ovs_u128 *mask)
error = parse_int_string(s, (uint8_t *)&be_mask,
sizeof be_mask, &s);
if (error) {
return error;
return 0;
}
*mask = ntoh128(be_mask);
} else {
Expand Down

0 comments on commit a99e918

Please sign in to comment.