In parse_odp_action__(), the value returned by parse_odp_push_nsh_action() is incremented by one before being returned. If it equals INT_MAX, the addition overflows, which is undefined behavior. Reject such input with -EINVAL before doing the addition.
Found by Coverity (INTEGER_OVERFLOW, return_value_error). Signed-off-by: Fei Wang <[email protected]> --- lib/odp-util.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/lib/odp-util.c b/lib/odp-util.c index 43bb23cec..91669f058 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -2496,7 +2496,8 @@ out: size_t offset = nl_msg_start_nested(actions, OVS_ACTION_ATTR_PUSH_NSH); nsh_key_to_attr(actions, &nsh, metadata, md_size, false); nl_msg_end_nested(actions, offset); - ret = n; + /* Consume the closing ')'. */ + ret = n + 1; } return ret; } @@ -2795,14 +2796,8 @@ parse_odp_action__(struct parse_odp_context *context, const char *s, } } - { - if (!strncmp(s, "push_nsh(", 9)) { - int retval = parse_odp_push_nsh_action(s, actions); - if (retval < 0) { - return retval; - } - return retval + 1; - } + if (!strncmp(s, "push_nsh(", 9)) { + return parse_odp_push_nsh_action(s, actions); } { -- 2.55.0.windows.2 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
