ofpbuf: Update msg when resizing ofpbuf.
authorAlex Wang <alexw@nicira.com>
Mon, 20 Jul 2015 06:13:14 +0000 (23:13 -0700)
committerAlex Wang <alexw@nicira.com>
Mon, 20 Jul 2015 17:19:12 +0000 (10:19 -0700)
commit38876d31f2283eaf71f4c8acab4b2dad538019ef
treeddfedfd886efc51d4fa6c8f53156708de3894eec
parentdfe5044ceff33c72b228f79bba163121fe7bdd53
ofpbuf: Update msg when resizing ofpbuf.

Commit 6fd6ed7 (ofpbuf: Simplify ofpbuf API.) introduced the
'header' and 'msg' pointers to 'struct ofpbuf'.  However, we
forget to update the 'msg' pointer when resizing ofpbuf.

This bug could cause serious issue.  For example, in the function
ofputil_encode_nx_packet_in(), the 'msg' pointer is populated in
ofpraw_alloc_xid() when creating the ofpbuf .  Later, the ofpbuf
memory can be reallocated due to the writing to the ofpbuf.
However, since the 'msg' pointer is not updated, the later use of
the 'ofpbuf->msg' will end up writing to either free'ed memory or
memory allocated for other struct.

This commit fixes the bug by always updating the 'header' and
'msg' pointers when the ofpbuf is resized.  Also, a simple test
is added.

Signed-off-by: Alex Wang <alexw@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
lib/ofpbuf.c
lib/ofpbuf.h
tests/.gitignore
tests/automake.mk
tests/library.at
tests/test-ofpbuf.c [new file with mode: 0644]