treewide: Avoid offsetting NULL pointers.

This is undefined behavior and was reported by UB Sanitizer:
  lib/meta-flow.c:3445:16: runtime error:
    member access within null pointer of type 'struct vl_mf_field'
      0 0x6aad0f in mf_get_vl_mff lib/meta-flow.c:3445
      1 0x6d96d7 in mf_from_oxm_header lib/nx-match.c:260
      2 0x6d9e2e in nx_pull_header__ lib/nx-match.c:341
      3 0x6daafa in nx_pull_header lib/nx-match.c:488
      4 0x6abcb6 in mf_vl_mff_nx_pull_header lib/meta-flow.c:3605
      5 0x73b9be in decode_NXAST_RAW_REG_MOVE lib/ofp-actions.c:2652
      6 0x764ccd in ofpact_decode lib/ofp-actions.inc2:4681
      [...]
  lib/sset.c:315:12: runtime error: applying zero offset to null pointer
      0 0xcc2e6a in sset_at_position lib/sset.c:315:12
      1 0x5734b3 in port_dump_next ofproto/ofproto-dpif.c:4083:20
      [...]
  lib/ovsdb-data.c:2194:56:
  runtime error: applying zero offset to null pointer
      0 0x5e9530 in ovsdb_datum_added_removed lib/ovsdb-data.c:2194:56
      1 0x4d6258 in update_row_ref_count ovsdb/transaction.c:335:17
      2 0x4c360b in for_each_txn_row ovsdb/transaction.c:1572:33
      [...]
  lib/ofpbuf.c:440:30:
  runtime error: applying zero offset to null pointer
      0 0x75066d in ofpbuf_push_uninit lib/ofpbuf.c:440
      1 0x46ac8a in ovnacts_parse lib/actions.c:4190
      2 0x46ad91 in ovnacts_parse_string lib/actions.c:4208
      3 0x4106d1 in test_parse_actions tests/test-ovn.c:1324
      [...]
  lib/ofp-actions.c:3205:22:
  runtime error: applying non-zero offset 2 to null pointer
      0 0x6e1641 in set_field_split_str lib/ofp-actions.c:3205:22
      [...]
  lib/tnl-ports.c:74:12:
  runtime error: applying zero offset to null pointer
      0 0xceffe7 in tnl_port_cast lib/tnl-ports.c:74:12
      1 0xcf14c3 in map_insert lib/tnl-ports.c:116:13
      [...]
  ofproto/ofproto.c:8905:16:
  runtime error: applying zero offset to null pointer
      0 0x556795 in eviction_group_hash_rule ofproto/ofproto.c:8905:16
      1 0x503f8d in eviction_group_add_rule ofproto/ofproto.c:9022:42
      [...]

Also, it's valid to have an empty ofpact list and we should be able to
try to iterate through it.

UB Sanitizer report:
  include/openvswitch/ofp-actions.h:222:12:
  runtime error: applying zero offset to null pointer
      0 0x665d69 in ofpact_end ./include/openvswitch/ofp-actions.h:222:12
      1 0x66b2cf in ofpacts_put_openflow_actions lib/ofp-actions.c:8861:5
      2 0x6ffdd1 in ofputil_encode_flow_mod lib/ofp-flow.c:447:9
      [...]

Signed-off-by: Dumitru Ceara <dceara@redhat.com>
Acked-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

1 files changed, 6 insertions, 2 deletions

diff --git a/lib/dynamic-string.c b/lib/dynamic-string.c
index fd0127ed1..6940e1fd6 100644
--- a/lib/dynamic-string.c
+++ b/lib/dynamic-string.c
@@ -152,7 +152,10 @@ ds_put_format_valist(struct ds *ds, const char *format, va_list args_)
 
     va_copy(args, args_);
     available = ds->string ? ds->allocated - ds->length + 1 : 0;
-    needed = vsnprintf(&ds->string[ds->length], available, format, args);
+    needed = vsnprintf(ds->string
+                       ? &ds->string[ds->length]
+                       : NULL,
+                       available, format, args);
     va_end(args);
 
     if (needed < available) {
@@ -162,7 +165,8 @@ ds_put_format_valist(struct ds *ds, const char *format, va_list args_)
 
         va_copy(args, args_);
         available = ds->allocated - ds->length + 1;
-        needed = vsnprintf(&ds->string[ds->length], available, format, args);
+        needed = vsnprintf(&ds->string[ds->length],
+                           available, format, args);
         va_end(args);
 
         ovs_assert(needed < available);