Skip to content
Permalink
Browse files

ovsdb: Fix reference to table's row on condition_add|remove_clause

Use struct uuid * on [add|remove]_clause on columns which are references to
tables. That prevents use-after-free errors.

Signed-off-by: Liran Schour <lirans@il.ibm.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>
  • Loading branch information...
liranschour authored and blp committed Aug 16, 2016
1 parent 903ba94 commit cc0e634aa4667a55a65630b166adb4540cbbe86e
Showing with 30 additions and 23 deletions.
  1. +20 −20 ovsdb/ovsdb-idlc.in
  2. +10 −3 python/ovs/db/types.py
@@ -28,7 +28,7 @@ def constify(cType, const):
else:
return cType

def cMembers(prefix, tableName, columnName, column, const):
def cMembers(prefix, tableName, columnName, column, const, refTable=True):
comment = ""
type = column.type

@@ -63,10 +63,10 @@ def cMembers(prefix, tableName, columnName, column, const):
valueName = "value_%s" % columnName

key = {'name': keyName,
'type': constify(type.key.toCType(prefix) + pointer, const),
'type': constify(type.key.toCType(prefix, refTable) + pointer, const),
'comment': ''}
value = {'name': valueName,
'type': constify(type.value.toCType(prefix) + pointer, const),
'type': constify(type.value.toCType(prefix, refTable) + pointer, const),
'comment': ''}

if singleton:
@@ -78,7 +78,7 @@ def cMembers(prefix, tableName, columnName, column, const):
members = [key, value]
else:
m = {'name': columnName,
'type': constify(type.key.toCType(prefix) + pointer, const),
'type': constify(type.key.toCType(prefix, refTable) + pointer, const),
'comment': type.cDeclComment()}

if singleton:
@@ -245,7 +245,7 @@ bool %(s)s_is_updated(const struct %(s)s *, enum %(s)s_column_id);
args = ['const struct smap *']
else:
comment, members = cMembers(prefix, tableName, columnName,
column, True)
column, True, refTable=False)
args = ['%(type)s%(name)s' % member for member in members]
print '%s);' % ', '.join(args)

@@ -259,7 +259,7 @@ bool %(s)s_is_updated(const struct %(s)s *, enum %(s)s_column_id);
args = ['const struct smap *']
else:
comment, members = cMembers(prefix, tableName, columnName,
column, True)
column, True, refTable=False)
args = ['%(type)s%(name)s' % member for member in members]
print '%s);' % ', '.join(args)

@@ -923,7 +923,7 @@ void
type = column.type

comment, members = cMembers(prefix, tableName, columnName,
column, True)
column, True, refTable=False)

if type.is_smap():
print comment
@@ -994,10 +994,10 @@ void
print " ovs_assert(inited);"
print " datum.n = 1;"
print " datum.keys = &key;"
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
if type.value:
print " datum.values = &value;"
print " "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar)
print " "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar, refTable=False)
else:
print " datum.values = NULL;"
elif type.is_optional_pointer():
@@ -1007,7 +1007,7 @@ void
print " if (%s) {" % keyVar
print " datum.n = 1;"
print " datum.keys = &key;"
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
print " } else {"
print " datum.n = 0;"
print " datum.keys = NULL;"
@@ -1020,7 +1020,7 @@ void
print " if (%s) {" % nVar
print " datum.n = 1;"
print " datum.keys = &key;"
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar)
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar, refTable=False)
print " } else {"
print " datum.n = 0;"
print " datum.keys = NULL;"
@@ -1037,9 +1037,9 @@ void
else:
print " datum.values = NULL;"
print " for (i = 0; i < %s; i++) {" % nVar
print " " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar)
print " " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar, refTable=False)
if type.value:
print " " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar)
print " " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar, refTable=False)
print " }"
if type.value:
valueType = type.value.toAtomicType()
@@ -1090,7 +1090,7 @@ void
type = column.type

comment, members = cMembers(prefix, tableName, columnName,
column, True)
column, True, refTable=False)

if type.is_smap():
print comment
@@ -1160,10 +1160,10 @@ void
print " ovs_assert(inited);"
print " datum.n = 1;"
print " datum.keys = &key;"
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
if type.value:
print " datum.values = &value;"
print " "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar)
print " "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar, refTable=False)
else:
print " datum.values = NULL;"
elif type.is_optional_pointer():
@@ -1173,7 +1173,7 @@ void
print " if (%s) {" % keyVar
print " datum.n = 1;"
print " datum.keys = &key;"
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
print " } else {"
print " datum.n = 0;"
print " datum.keys = NULL;"
@@ -1186,7 +1186,7 @@ void
print " if (%s) {" % nVar
print " datum.n = 1;"
print " datum.keys = &key;"
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar)
print " " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar, refTable=False)
print " } else {"
print " datum.n = 0;"
print " datum.keys = NULL;"
@@ -1203,9 +1203,9 @@ void
else:
print " datum.values = NULL;"
print " for (i = 0; i < %s; i++) {" % nVar
print " " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar)
print " " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar, refTable=False)
if type.value:
print " " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar)
print " " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar, refTable=False)
print " }"
if type.value:
valueType = type.value.toAtomicType()
@@ -339,8 +339,11 @@ def constraintsToEnglish(self, escapeLiteral=returnUnchanged,

return english

def toCType(self, prefix):
def toCType(self, prefix, refTable=True):
if self.ref_table_name:
if not refTable:
assert self.type == UuidType
return 'struct uuid *'
return "struct %s%s *" % (prefix, self.ref_table_name.lower())
else:
return {IntegerType: 'int64_t ',
@@ -352,18 +355,22 @@ def toCType(self, prefix):
def toAtomicType(self):
return "OVSDB_TYPE_%s" % self.type.to_string().upper()

def copyCValue(self, dst, src):
def copyCValue(self, dst, src, refTable=True):
args = {'dst': dst, 'src': src}
if self.ref_table_name:
if not refTable:
return "%(dst)s = *%(src)s;" % args
return ("%(dst)s = %(src)s->header_.uuid;") % args
elif self.type == StringType:
return "%(dst)s = xstrdup(%(src)s);" % args
else:
return "%(dst)s = %(src)s;" % args

def assign_c_value_casting_away_const(self, dst, src):
def assign_c_value_casting_away_const(self, dst, src, refTable=True):
args = {'dst': dst, 'src': src}
if self.ref_table_name:
if not refTable:
return "%(dst)s = *%(src)s;" % args
return ("%(dst)s = %(src)s->header_.uuid;") % args
elif self.type == StringType:
return "%(dst)s = CONST_CAST(char *, %(src)s);" % args

0 comments on commit cc0e634

Please sign in to comment.
You can’t perform that action at this time.