Don't panic, this is not a remote buffer overflow, only a bug in a program
parsing its input from the command line or a file.
Found by inspection.
Signed-off-by: Ben Pfaff <b...@nicira.com>
---
lib/learn.c | 6 +++++-
tests/learn.at | 14 ++++++++++++++
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/lib/learn.c b/lib/learn.c
index 71c9780..de4f2a7 100644
--- a/lib/learn.c
+++ b/lib/learn.c
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2011, 2012, 2013, 2014 Nicira, Inc.
+ * Copyright (c) 2011, 2012, 2013, 2014, 2015 Nicira, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -207,6 +207,10 @@ learn_parse_load_immediate(const char *s, struct
ofpact_learn_spec *spec)
if (hexit < 0) {
return xasprintf("%s: bad hex digit in value", full_s);
}
+ if (hexit && i / 2 >= sizeof imm.u8) {
+ return xasprintf("%s: too many bits in immediate value",
+ full_s);
+ }
out[-(i / 2)] |= i % 2 ? hexit << 4 : hexit;
}
s = arrow;
diff --git a/tests/learn.at b/tests/learn.at
index 322ab84..0372e4a 100644
--- a/tests/learn.at
+++ b/tests/learn.at
@@ -91,6 +91,20 @@ ovs-ofctl: actions are invalid with specified match
(OFPBAC_MATCH_INCONSISTENT)
]])
AT_CLEANUP
+AT_SETUP([learning action - too-long immediate value])
+dnl 129 bits is too long.
+AT_CHECK([[ovs-ofctl parse-flow
'actions=learn(load:0x1fedbca9876543210fedbca9876543210->NXM_NX_IPV6_DST[])']],
+ [1], [], [[ovs-ofctl:
0x1fedbca9876543210fedbca9876543210->NXM_NX_IPV6_DST[]: too many bits in
immediate value
+]])
+
+dnl 128 bits is merely a bad prerequisite.
+AT_CHECK([[ovs-ofctl parse-flow
'actions=learn(load:0xfedbca9876543210fedbca9876543210->NXM_NX_IPV6_DST[])']],
[1], [], [stderr])
+AT_CHECK([sed -e 's/.*|meta_flow|WARN|//' < stderr], [0],
+ [[destination field ipv6_dst lacks correct prerequisites
+ovs-ofctl: actions are invalid with specified match (OFPBAC_MATCH_INCONSISTENT)
+]], [[]])
+AT_CLEANUP
+
AT_SETUP([learning action - standard VLAN+MAC learning])
OVS_VSWITCHD_START(
[add-port br0 p1 -- set Interface p1 type=dummy ofport_request=1 -- \
--
2.1.3
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
