From 5d6ac33c970687aa5f7d63a61a8a543d3ae62901 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Fri, 22 Sep 2017 14:50:41 -0700 Subject: ofp-util: Fix buffer overread in ofputil_decode_bundle_add(). A buffer overread of up to 4 bytes was possible given a malformed message. The message was discarded following the overread. Found by libFuzzer. Reported-by: Bhargava Shastry Signed-off-by: Ben Pfaff Acked-by: Justin Pettit --- lib/ofp-util.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'lib/ofp-util.c') diff --git a/lib/ofp-util.c b/lib/ofp-util.c index 86dd5cb61..319f8cfd1 100644 --- a/lib/ofp-util.c +++ b/lib/ofp-util.c @@ -10509,14 +10509,21 @@ ofputil_decode_bundle_add(const struct ofp_header *oh, enum ofptype *typep) { struct ofpbuf b = ofpbuf_const_initializer(oh, ntohs(oh->length)); + + /* Pull the outer ofp_header. */ enum ofpraw raw = ofpraw_pull_assert(&b); ovs_assert(raw == OFPRAW_OFPT14_BUNDLE_ADD_MESSAGE || raw == OFPRAW_ONFT13_BUNDLE_ADD_MESSAGE); + /* Pull the bundle_ctrl header. */ const struct ofp14_bundle_ctrl_msg *m = ofpbuf_pull(&b, sizeof *m); msg->bundle_id = ntohl(m->bundle_id); msg->flags = ntohs(m->flags); + /* Pull the inner ofp_header. */ + if (b.size < sizeof(struct ofp_header)) { + return OFPERR_OFPBFC_MSG_BAD_LEN; + } msg->msg = b.data; if (msg->msg->version != oh->version) { return OFPERR_OFPBFC_BAD_VERSION; -- cgit v1.2.1