diff options
author | Ben Pfaff <blp@ovn.org> | 2017-09-21 09:59:58 -0700 |
---|---|---|
committer | Ben Pfaff <blp@ovn.org> | 2017-09-22 14:57:33 -0700 |
commit | f673f4059717dc9d2d6dd2d4db52be1149a996dd (patch) | |
tree | 2f81da8c4d44a60fc51b31b05f02d02b1e6a86a9 /lib | |
parent | 77ad4225d125030420d897c873e4734ac708c66b (diff) | |
download | openvswitch-f673f4059717dc9d2d6dd2d4db52be1149a996dd.tar.gz |
ofp-util: Fix memory leaks when parsing OF1.5 group properties.
Found by libFuzzer.
Reported-by: Bhargava Shastry <bshastry@sec.t-labs.tu-berlin.de>
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Justin Pettit <jpettit@ovn.org>
Diffstat (limited to 'lib')
-rw-r--r-- | lib/ofp-util.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/lib/ofp-util.c b/lib/ofp-util.c index 9f69c31e0..0d4dfb27e 100644 --- a/lib/ofp-util.c +++ b/lib/ofp-util.c @@ -9581,8 +9581,13 @@ ofputil_decode_ofp15_group_desc_reply(struct ofputil_group_desc *gd, * Such properties are valid for group desc replies so * claim that the group mod command is OFPGC15_ADD to * satisfy the check in parse_group_prop_ntr_selection_method() */ - return parse_ofp15_group_properties(msg, gd->type, OFPGC15_ADD, &gd->props, - length - sizeof *ogds - bucket_list_len); + error = parse_ofp15_group_properties( + msg, gd->type, OFPGC15_ADD, &gd->props, + length - sizeof *ogds - bucket_list_len); + if (error) { + ofputil_bucket_list_destroy(&gd->buckets); + } + return error; } /* Converts a group description reply in 'msg' into an abstract @@ -9881,8 +9886,12 @@ ofputil_pull_ofp15_group_mod(struct ofpbuf *msg, enum ofp_version ofp_version, return error; } - return parse_ofp15_group_properties(msg, gm->type, gm->command, &gm->props, - msg->size); + error = parse_ofp15_group_properties(msg, gm->type, gm->command, + &gm->props, msg->size); + if (error) { + ofputil_bucket_list_destroy(&gm->buckets); + } + return error; } static enum ofperr |