> On Nov 27, 2017, at 9:20 AM, Ben Pfaff <b...@ovn.org> wrote: > > These lines of code are intended to copy the 'next' and 'next_max' members > of tbl[type] into local variables 'tbl' and 'max': > tbl = tbl[type].next; > max = tbl[type].next_max; > They didn't do it properly because the first line changes 'tbl', so that > the first and seconds lines' references to tbl[type] refer to different > objects. > > This commit fixes the problem. > > Found by libfuzzer. > > Reported-by: Bhargava Shastry <bshas...@sec.t-labs.tu-berlin.de> > Signed-off-by: Ben Pfaff <b...@ovn.org>
Acked-by: Justin Pettit <jpet...@ovn.org> --Justin _______________________________________________ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev