In this piece of code, 'struct ofpbuf b' should always point to metadata so that metadata can be filled with values through ofpbuf operations, like ofpbuf_put_hex and ofpbuf_push_zeros. However, ofpbuf_push_zeros may change the data pointer of 'struct ofpbuf b' and therefore, metadata will not contain the expected values. This patch fixes it.
Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10863 Signed-off-by: Yifeng Sun <pkusunyif...@gmail.com> --- lib/odp-util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/odp-util.c b/lib/odp-util.c index cb6a5f2047fd..af855873690c 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -2114,12 +2114,12 @@ parse_odp_push_nsh_action(const char *s, struct ofpbuf *actions) if (ovs_scan_len(s, &n, "md2=0x%511[0-9a-fA-F]", buf) && n/2 <= sizeof metadata) { ofpbuf_use_stub(&b, metadata, sizeof metadata); - ofpbuf_put_hex(&b, buf, &mdlen); /* Pad metadata to 4 bytes. */ padding = PAD_SIZE(mdlen, 4); if (padding > 0) { - ofpbuf_push_zeros(&b, padding); + ofpbuf_put_zeros(&b, padding); } + ofpbuf_put_hex(&b, buf, &mdlen); md_size = mdlen + padding; ofpbuf_uninit(&b); continue; -- 2.7.4 _______________________________________________ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev
