From 7b7b186a8d40fc6f287cef2582702181da74bdc3 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Sat, 20 May 2017 16:38:24 -0700 Subject: [PATCH] ofp-util: Fix buffer overread in ofputil_pull_queue_get_config_reply10(). msg->size isn't the relevant measurement here because we're only supposed to read 'len' bytes. Reading more than that causes 'len' to underflow to a large number at the end of the loop. Reported-by: Bhargava Shastry Signed-off-by: Ben Pfaff Acked-by: Greg Rose --- lib/ofp-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ofp-util.c b/lib/ofp-util.c index db27abf8b..a6dd5dbdd 100644 --- a/lib/ofp-util.c +++ b/lib/ofp-util.c @@ -2598,7 +2598,7 @@ ofputil_pull_queue_get_config_reply10(struct ofpbuf *msg, hdr = ofpbuf_at_assert(msg, 0, sizeof *hdr); prop_len = ntohs(hdr->len); - if (prop_len < sizeof *hdr || prop_len > msg->size || prop_len % 8) { + if (prop_len < sizeof *hdr || prop_len > len || prop_len % 8) { return OFPERR_OFPBRC_BAD_LEN; } -- 2.12.2