[ovs-git] [openvswitch/ovs] 1752ea: ofp-util: Check length of buckets in ofputil_pull_...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: 1752ea92dc11935e0595d208fdfe8203baf5b55c
      https://github.com/openvswitch/ovs/commit/1752ea92dc11935e0595d208fdfe8203baf5b55c
  Author: Ben Pfaff <blp at ovn.org>
  Date:   2017-07-07 (Fri, 07 Jul 2017)

  Changed paths:
    M lib/ofp-util.c

  Log Message:
  -----------
  ofp-util: Check length of buckets in ofputil_pull_ofp15_group_mod().

This code blindly read forward for the number of bytes specified by the
message without checking that it was in range.

This bug is part of OpenFlow 1.5 support.  Open vSwitch does not enable
OpenFlow 1.5 support by default.

Reported-by: Bhargava Shastry <bshastry at sec.t-labs.tu-berlin.de>
Signed-off-by: Ben Pfaff <blp at ovn.org>
Acked-by: Yi-Hung Wei <yihung.wei at gmail.com>