[ovs-git] [openvswitch/ovs] 9cdb3e: ofp-util: Check length of buckets in ofputil_pull_...

[GitHub]

  Branch: refs/heads/branch-2.5
  Home:   https://github.com/openvswitch/ovs
  Commit: 9cdb3e7c373cdcf5072372631e31d13f1a600e91
      https://github.com/openvswitch/ovs/commit/9cdb3e7c373cdcf5072372631e31d13f1a600e91
  Author: Ben Pfaff <blp at ovn.org>
  Date:   2017-07-07 (Fri, 07 Jul 2017)

  Changed paths:
    M lib/ofp-util.c

  Log Message:
  -----------
  ofp-util: Check length of buckets in ofputil_pull_ofp15_group_mod().

This code blindly read forward for the number of bytes specified by the
message without checking that it was in range.

This bug is part of OpenFlow 1.5 support.  Open vSwitch does not enable
OpenFlow 1.5 support by default.

Reported-by: Bhargava Shastry <bshastry at sec.t-labs.tu-berlin.de>
Signed-off-by: Ben Pfaff <blp at ovn.org>
Acked-by: Yi-Hung Wei <yihung.wei at gmail.com>