Functions like scan_u8, return 0 when they failed to scan the expected values. Function scan_geneve failed to check this situation. This leads to using of uninitialized value of opt_len_mask. This patch fixes it and further inspects and fixes all the problematic places where the return values of scan_XXX functions are not properly handled.
Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10800 Signed-off-by: Yifeng Sun <pkusunyif...@gmail.com> --- v1->v2: Fix a compiler warning, ovs-dev-bounces complains [ovs-dev] in the subject, remove it. lib/odp-util.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 52 insertions(+), 13 deletions(-) diff --git a/lib/odp-util.c b/lib/odp-util.c index 1a52f3bc5ad9..626a03b7686f 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -1915,8 +1915,8 @@ find_end: s += n; retval = scan_u128(s, &ct_label.value, &ct_label.mask); - if (retval < 0) { - return retval; + if (retval == 0) { + return -EINVAL; } s += retval; continue; @@ -4806,10 +4806,15 @@ scan_vxlan_gbp(const char *s, uint32_t *key, uint32_t *mask) const char *s_base = s; ovs_be16 id = 0, id_mask = 0; uint8_t flags = 0, flags_mask = 0; + int len; if (!strncmp(s, "id=", 3)) { s += 3; - s += scan_be16(s, &id, mask ? &id_mask : NULL); + len = scan_be16(s, &id, mask ? &id_mask : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } if (s[0] == ',') { @@ -4817,7 +4822,11 @@ scan_vxlan_gbp(const char *s, uint32_t *key, uint32_t *mask) } if (!strncmp(s, "flags=", 6)) { s += 6; - s += scan_u8(s, &flags, mask ? &flags_mask : NULL); + len = scan_u8(s, &flags, mask ? &flags_mask : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } if (!strncmp(s, "))", 2)) { @@ -4843,10 +4852,15 @@ scan_erspan_metadata(const char *s, uint32_t idx = 0, idx_mask = 0; uint8_t ver = 0, dir = 0, hwid = 0; uint8_t ver_mask = 0, dir_mask = 0, hwid_mask = 0; + int len; if (!strncmp(s, "ver=", 4)) { s += 4; - s += scan_u8(s, &ver, mask ? &ver_mask : NULL); + len = scan_u8(s, &ver, mask ? &ver_mask : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } if (s[0] == ',') { @@ -4856,7 +4870,11 @@ scan_erspan_metadata(const char *s, if (ver == 1) { if (!strncmp(s, "idx=", 4)) { s += 4; - s += scan_u32(s, &idx, mask ? &idx_mask : NULL); + len = scan_u32(s, &idx, mask ? &idx_mask : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } if (!strncmp(s, ")", 1)) { @@ -4872,14 +4890,22 @@ scan_erspan_metadata(const char *s, } else if (ver == 2) { if (!strncmp(s, "dir=", 4)) { s += 4; - s += scan_u8(s, &dir, mask ? &dir_mask : NULL); + len = scan_u8(s, &dir, mask ? &dir_mask : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } if (s[0] == ',') { s++; } if (!strncmp(s, "hwid=", 5)) { s += 5; - s += scan_u8(s, &hwid, mask ? &hwid_mask : NULL); + len = scan_u8(s, &hwid, mask ? &hwid_mask : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } if (!strncmp(s, ")", 1)) { @@ -4905,6 +4931,7 @@ scan_geneve(const char *s, struct geneve_scan *key, struct geneve_scan *mask) struct geneve_opt *opt = key->d; struct geneve_opt *opt_mask = mask ? mask->d : NULL; int len_remain = sizeof key->d; + int len; while (s[0] == '{' && len_remain >= sizeof *opt) { int data_len = 0; @@ -4914,8 +4941,12 @@ scan_geneve(const char *s, struct geneve_scan *key, struct geneve_scan *mask) if (!strncmp(s, "class=", 6)) { s += 6; - s += scan_be16(s, &opt->opt_class, - mask ? &opt_mask->opt_class : NULL); + len = scan_be16(s, &opt->opt_class, + mask ? &opt_mask->opt_class : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } else if (mask) { memset(&opt_mask->opt_class, 0, sizeof opt_mask->opt_class); } @@ -4925,7 +4956,11 @@ scan_geneve(const char *s, struct geneve_scan *key, struct geneve_scan *mask) } if (!strncmp(s, "type=", 5)) { s += 5; - s += scan_u8(s, &opt->type, mask ? &opt_mask->type : NULL); + len = scan_u8(s, &opt->type, mask ? &opt_mask->type : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; } else if (mask) { memset(&opt_mask->type, 0, sizeof opt_mask->type); } @@ -4936,7 +4971,11 @@ scan_geneve(const char *s, struct geneve_scan *key, struct geneve_scan *mask) if (!strncmp(s, "len=", 4)) { uint8_t opt_len, opt_len_mask; s += 4; - s += scan_u8(s, &opt_len, mask ? &opt_len_mask : NULL); + len = scan_u8(s, &opt_len, mask ? &opt_len_mask : NULL); + if (len == 0) { + return -EINVAL; + } + s += len; if (opt_len > 124 || opt_len % 4 || opt_len > len_remain) { return 0; @@ -4981,7 +5020,7 @@ scan_geneve(const char *s, struct geneve_scan *key, struct geneve_scan *mask) } if (s[0] == ')') { - int len = sizeof key->d - len_remain; + len = sizeof key->d - len_remain; s++; key->len = len; -- 2.7.4 _______________________________________________ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev