From: Joe Stringer <joe@ovn.org>
Date: Thu, 3 Mar 2016 08:22:50 +0000 (+1300)
Subject: ofp-actions: Prevent integer overflow in decode.
X-Git-Url: http://git.cascardo.info/?p=cascardo%2Fovs.git;a=commitdiff_plain;h=5308056f53406e75d211f73a2847f9ebdf9c91c8

ofp-actions: Prevent integer overflow in decode.

When decoding a variable-length action, if the length of the action
exceeds the length storable in a uint16_t then something has gone
terribly wrong. Assert that this is not the case.

Signed-off-by: Joe Stringer <joe@ovn.org>
Acked-by: Jarno Rajahalme <jarno@ovn.org>
---

diff --git a/lib/ofp-actions.c b/lib/ofp-actions.c
index fe1424f13..905469b6b 100644
--- a/lib/ofp-actions.c
+++ b/lib/ofp-actions.c
@@ -7401,8 +7401,12 @@ ofpact_init(struct ofpact *ofpact, enum ofpact_type type, size_t len)
 void
 ofpact_finish(struct ofpbuf *ofpacts, struct ofpact *ofpact)
 {
+    ptrdiff_t len;
+
     ovs_assert(ofpact == ofpacts->header);
-    ofpact->len = (char *) ofpbuf_tail(ofpacts) - (char *) ofpact;
+    len = (char *) ofpbuf_tail(ofpacts) - (char *) ofpact;
+    ovs_assert(len <= UINT16_MAX);
+    ofpact->len = len;
     ofpbuf_padto(ofpacts, OFPACT_ALIGN(ofpacts->size));
 }