From: David Marchand <david.march...@6wind.com> Add some basic checks on the segments offset and length metadata: always funny to have a < 0 tailroom cast to uint16_t ;-).
Signed-off-by: David Marchand <david.march...@6wind.com> Signed-off-by: David Marchand <david.march...@redhat.com> Acked-by: Olivier Matz <olivier.m...@6wind.com> --- lib/librte_mbuf/rte_mbuf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c index 9790b4f..3bbd3f5 100644 --- a/lib/librte_mbuf/rte_mbuf.c +++ b/lib/librte_mbuf/rte_mbuf.c @@ -200,6 +200,10 @@ struct rte_mempool * pkt_len = m->pkt_len; do { + if (m->data_off > m->buf_len) + rte_panic("data offset too big in mbuf segment\n"); + if (m->data_off + m->data_len > m->buf_len) + rte_panic("data length too big in mbuf segment\n"); nb_segs -= 1; pkt_len -= m->data_len; } while ((m = m->next) != NULL); -- 1.8.3.1