Helin, is this patch valid and important?
2015-02-12 19:22, Jingjing Wu:
> Klocwork reports array 'src_offset' may use index 16.
> In function i40e_srcoff_to_flx_pit, index j + 1 can reach
> I40E_FDIR_MAX_FLEX_LEN.
> This patch fixes this issue to avoid array bound.
>
> Signed-off-by: Jingjing Wu <jingjing.wu at intel.com>
> ---
> lib/librte_pmd_i40e/i40e_fdir.c | 35 +++++++++++++++++------------------
> 1 file changed, 17 insertions(+), 18 deletions(-)
>
> diff --git a/lib/librte_pmd_i40e/i40e_fdir.c b/lib/librte_pmd_i40e/i40e_fdir.c
> index 68511c8..bc36d8e 100644
> --- a/lib/librte_pmd_i40e/i40e_fdir.c
> +++ b/lib/librte_pmd_i40e/i40e_fdir.c
> @@ -402,28 +402,27 @@ i40e_srcoff_to_flx_pit(const uint16_t *src_offset,
>
> while (j < I40E_FDIR_MAX_FLEX_LEN) {
> size = 1;
> - for (; j < I40E_FDIR_MAX_FLEX_LEN; j++) {
> + for (; j < I40E_FDIR_MAX_FLEX_LEN - 1; j++) {
> if (src_offset[j + 1] == src_offset[j] + 1)
> size++;
> - else {
> - src_tmp = src_offset[j] + 1 - size;
> - /* the flex_pit need to be sort by scr_offset */
> - for (i = 0; i < num; i++) {
> - if (src_tmp < flex_pit[i].src_offset)
> - break;
> - }
> - /* if insert required, move backward */
> - for (k = num; k > i; k--)
> - flex_pit[k] = flex_pit[k - 1];
> - /* insert */
> - flex_pit[i].dst_offset = j + 1 - size;
> - flex_pit[i].src_offset = src_tmp;
> - flex_pit[i].size = size;
> - j++;
> - num++;
> + else
> + break;
> + }
> + src_tmp = src_offset[j] + 1 - size;
> + /* the flex_pit need to be sort by src_offset */
> + for (i = 0; i < num; i++) {
> + if (src_tmp < flex_pit[i].src_offset)
> break;
> - }
> }
> + /* if insert required, move backward */
> + for (k = num; k > i; k--)
> + flex_pit[k] = flex_pit[k - 1];
> + /* insert */
> + flex_pit[i].dst_offset = j + 1 - size;
> + flex_pit[i].src_offset = src_tmp;
> + flex_pit[i].size = size;
> + j++;
> + num++;
> }
> return num;
> }
>
