[ovs-git] [openvswitch/ovs] 464cc3: odp-util: Avoid reading wrong table in generate_al...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: 464cc3ee5094d799ddfd49cdec5727e0162483ec
      https://github.com/openvswitch/ovs/commit/464cc3ee5094d799ddfd49cdec5727e0162483ec
  Author: Ben Pfaff <blp at ovn.org>
  Date:   2017-12-21 (Thu, 21 Dec 2017)

  Changed paths:
    M lib/odp-util.c

  Log Message:
  -----------
  odp-util: Avoid reading wrong table in generate_all_wildcard_mask().

These lines of code are intended to copy the 'next' and 'next_max' members
of tbl[type] into local variables 'tbl' and 'max':
      tbl = tbl[type].next;
      max = tbl[type].next_max;
They didn't do it properly because the first line changes 'tbl', so that
the first and seconds lines' references to tbl[type] refer to different
objects.

This commit fixes the problem.

Found by libfuzzer.

Reported-by: Bhargava Shastry <bshastry at sec.t-labs.tu-berlin.de>
Signed-off-by: Ben Pfaff <blp at ovn.org>
Acked-by: Justin Pettit <jpettit at ovn.org>