[ovs-dev] [PATCH] ofp-actions: Set an action depth limit to prevent stackoverflow by ofpacts_parse

[Yifeng Sun]

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12557
Signed-off-by: Yifeng Sun <pkusunyif...@gmail.com>
---
 include/openvswitch/ofp-actions.h | 4 ++++
 lib/ofp-actions.c                 | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/include/openvswitch/ofp-actions.h 
b/include/openvswitch/ofp-actions.h
index caaa37c05a1d..14c5eab74bd3 100644
--- a/include/openvswitch/ofp-actions.h
+++ b/include/openvswitch/ofp-actions.h
@@ -1175,7 +1175,11 @@ struct ofpact_parse_params {
     /* Output. */
     struct ofpbuf *ofpacts;
     enum ofputil_protocol *usable_protocols;
+
+    /* Parse context. */
+    unsigned int depth;
 };
+#define MAX_OFPACT_PARSE_DEPTH 100
 char *ofpacts_parse_actions(const char *, const struct ofpact_parse_params *)
     OVS_WARN_UNUSED_RESULT;
 char *ofpacts_parse_instructions(const char *,
diff --git a/lib/ofp-actions.c b/lib/ofp-actions.c
index f76db6c0f948..6f175186498d 100644
--- a/lib/ofp-actions.c
+++ b/lib/ofp-actions.c
@@ -9062,11 +9062,16 @@ static char * OVS_WARN_UNUSED_RESULT
 ofpacts_parse(char *str, const struct ofpact_parse_params *pp,
               bool allow_instructions, enum ofpact_type outer_action)
 {
+    if (pp->depth >= MAX_OFPACT_PARSE_DEPTH) {
+        return xstrdup("Action nested too deeply");
+    }
+    CONST_CAST(struct ofpact_parse_params *, pp)->depth++;
     uint32_t orig_size = pp->ofpacts->size;
     char *error = ofpacts_parse__(str, pp, allow_instructions, outer_action);
     if (error) {
         pp->ofpacts->size = orig_size;
     }
+    CONST_CAST(struct ofpact_parse_params *, pp)->depth--;
     return error;
 }
 
-- 
2.7.4

_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev