From: David Marchand <david.march...@6wind.com>

Add some basic checks on the segments offset and length metadata:
always funny to have a < 0 tailroom cast to uint16_t ;-).

Signed-off-by: David Marchand <david.march...@6wind.com>
Signed-off-by: David Marchand <david.march...@redhat.com>
Acked-by: Olivier Matz <olivier.m...@6wind.com>
---
 lib/librte_mbuf/rte_mbuf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
index 9790b4f..3bbd3f5 100644
--- a/lib/librte_mbuf/rte_mbuf.c
+++ b/lib/librte_mbuf/rte_mbuf.c
@@ -200,6 +200,10 @@ struct rte_mempool *
        pkt_len = m->pkt_len;
 
        do {
+               if (m->data_off > m->buf_len)
+                       rte_panic("data offset too big in mbuf segment\n");
+               if (m->data_off + m->data_len > m->buf_len)
+                       rte_panic("data length too big in mbuf segment\n");
                nb_segs -= 1;
                pkt_len -= m->data_len;
        } while ((m = m->next) != NULL);
-- 
1.8.3.1

Reply via email to