diff options
| author | Paul Boca <pboca@cloudbasesolutions.com> | 2016-04-27 08:05:47 +0000 |
|---|---|---|
| committer | Ben Pfaff <blp@ovn.org> | 2016-05-16 22:04:58 -0700 |
| commit | e6b298ef73816355e94e22a7df0cd28414957087 (patch) | |
| tree | 502a15bcf85497676f561f13e5fcb8b98dd19e67 /datapath-windows/ovsext/Vport.c | |
| parent | 59936df6f45cf554ca201a08d8335af04d82a82c (diff) | |
| download | openvswitch-e6b298ef73816355e94e22a7df0cd28414957087.tar.gz | |
datapath-windows: Validate Netlink packets' integrity.
Solved access violation when trying to access Netlink message - obtained
with forged IOCTLs.
Signed-off-by: Paul-Daniel Boca <pboca@cloudbasesolutions.com>
Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>
Diffstat (limited to 'datapath-windows/ovsext/Vport.c')
| -rw-r--r-- | datapath-windows/ovsext/Vport.c | 34 |
1 files changed, 18 insertions, 16 deletions
diff --git a/datapath-windows/ovsext/Vport.c b/datapath-windows/ovsext/Vport.c index d04b12be0..429916961 100644 --- a/datapath-windows/ovsext/Vport.c +++ b/datapath-windows/ovsext/Vport.c @@ -1729,9 +1729,9 @@ cleanup: if (nlError != NL_ERROR_SUCCESS) { POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) usrParamsCtx->outputBuffer; + UINT32 msgErrorLen = usrParamsCtx->outputLength; - NlBuildErrorMsg(msgIn, msgError, nlError); - *replyLen = msgError->nlMsg.nlmsgLen; + NlBuildErrorMsg(msgIn, msgError, msgErrorLen, nlError, replyLen); } return STATUS_SUCCESS; @@ -2088,9 +2088,9 @@ Cleanup: if (nlError != NL_ERROR_SUCCESS) { POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) usrParamsCtx->outputBuffer; + UINT32 msgErrorLen = usrParamsCtx->outputLength; - NlBuildErrorMsg(msgIn, msgError, nlError); - *replyLen = msgError->nlMsg.nlmsgLen; + NlBuildErrorMsg(msgIn, msgError, msgErrorLen, nlError, replyLen); } return STATUS_SUCCESS; @@ -2324,6 +2324,7 @@ Cleanup: if ((nlError != NL_ERROR_SUCCESS) && (nlError != NL_ERROR_PENDING)) { POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) usrParamsCtx->outputBuffer; + UINT32 msgErrorLen = usrParamsCtx->outputLength; if (vport && vportAllocated == TRUE) { if (vportInitialized == TRUE) { @@ -2343,8 +2344,7 @@ Cleanup: OvsFreeMemoryWithTag(vport, OVS_VPORT_POOL_TAG); } - NlBuildErrorMsg(msgIn, msgError, nlError); - *replyLen = msgError->nlMsg.nlmsgLen; + NlBuildErrorMsg(msgIn, msgError, msgErrorLen, nlError, replyLen); } return (status == STATUS_PENDING) ? STATUS_PENDING : STATUS_SUCCESS; @@ -2452,9 +2452,9 @@ Cleanup: if (nlError != NL_ERROR_SUCCESS) { POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) usrParamsCtx->outputBuffer; + UINT32 msgErrorLen = usrParamsCtx->outputLength; - NlBuildErrorMsg(msgIn, msgError, nlError); - *replyLen = msgError->nlMsg.nlmsgLen; + NlBuildErrorMsg(msgIn, msgError, msgErrorLen, nlError, replyLen); } return STATUS_SUCCESS; @@ -2544,9 +2544,9 @@ Cleanup: if ((nlError != NL_ERROR_SUCCESS) && (nlError != NL_ERROR_PENDING)) { POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) usrParamsCtx->outputBuffer; + UINT32 msgErrorLen = usrParamsCtx->outputLength; - NlBuildErrorMsg(msgIn, msgError, nlError); - *replyLen = msgError->nlMsg.nlmsgLen; + NlBuildErrorMsg(msgIn, msgError, msgErrorLen, nlError, replyLen); } return (status == STATUS_PENDING) ? STATUS_PENDING : STATUS_SUCCESS; @@ -2579,10 +2579,11 @@ OvsTunnelVportPendingRemove(PVOID context, *replyLen = msgOut->nlMsg.nlmsgLen; } else { - POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR)msgOut; + POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) + tunnelContext->outputBuffer; + UINT32 msgErrorLen = tunnelContext->outputLength; - NlBuildErrorMsg(msgIn, msgError, nlError); - *replyLen = msgError->nlMsg.nlmsgLen; + NlBuildErrorMsg(msgIn, msgError, msgErrorLen, nlError, replyLen); } } @@ -2721,12 +2722,13 @@ OvsTunnelVportPendingInit(PVOID context, } while (error); if (error) { - POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) msgOut; + POVS_MESSAGE_ERROR msgError = (POVS_MESSAGE_ERROR) + tunnelContext->outputBuffer; + UINT32 msgErrorLen = tunnelContext->outputLength; OvsCleanupVxlanTunnel(NULL, vport, NULL, NULL); OvsFreeMemory(vport); - NlBuildErrorMsg(msgIn, msgError, nlError); - *replyLen = msgError->nlMsg.nlmsgLen; + NlBuildErrorMsg(msgIn, msgError, msgErrorLen, nlError, replyLen); } } |