[ovs-dev] [PATCH] ofp-util: Avoid use-after-free error in ofputil_append_meter_config()

[Andy Zhou]

On Tue, Dec 15, 2015 at 10:51 PM, Ben Pfaff <blp at ovn.org> wrote:
> Reported-by: weizj <334965317 at qq.com>
> Reported-at: https://github.com/openvswitch/ovs/pull/97
> Signed-off-by: Ben Pfaff <blp at ovn.org>

This fix makes sense to me.
Acked-by: Andy Zhou <azhou at ovn.org>

If all assignments to 'reply' were grouped together, it may be
slightly easier to read.

> ---
>  AUTHORS        | 1 +
>  lib/ofp-util.c | 1 +
>  2 files changed, 2 insertions(+)
>
> diff --git a/AUTHORS b/AUTHORS
> index c5c9d51..cc1673c 100644
> --- a/AUTHORS
> +++ b/AUTHORS
> @@ -413,6 +413,7 @@ kk yap                  yapkke at stanford.edu
>  likunyun                kunyunli at hotmail.com
>  neeraj mehta            mehtaneeraj07 at gmail.com
>  rahim entezari          rahim.entezari at gmail.com
> +weizj                   34965317 at qq.com
>  俊 赵                    zhaojun12 at outlook.com
>  冯全树(Crab)            fqs888 at 126.com
>  胡靖飞                  hujingfei914 at msn.com
> diff --git a/lib/ofp-util.c b/lib/ofp-util.c
> index d7e9ccc..31f9e93 100644
> --- a/lib/ofp-util.c
> +++ b/lib/ofp-util.c
> @@ -2039,6 +2039,7 @@ ofputil_append_meter_config(struct ovs_list *replies,
>
>      ofputil_put_bands(mc->n_bands, mc->bands, msg);
>
> +    reply = ofpbuf_at_assert(msg, start_ofs, sizeof *reply);
>      reply->length = htons(msg->size - start_ofs);
>
>      ofpmp_postappend(replies, start_ofs);
> --
> 2.1.3
>
> _______________________________________________
> dev mailing list
> dev at openvswitch.org
> http://openvswitch.org/mailman/listinfo/dev