[ovs-git] [openvswitch/ovs] fc2534: nx-match: Avoid double-free on some error paths.

GitHub noreply at github.com
Thu Aug 30 20:54:25 UTC 2018


  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: fc253483d6c874295c1a9eb7a86f44d2fe4f57ee
      https://github.com/openvswitch/ovs/commit/fc253483d6c874295c1a9eb7a86f44d2fe4f57ee
  Author: Ben Pfaff <blp at ovn.org>
  Date:   2018-08-30 (Thu, 30 Aug 2018)

  Changed paths:
    M lib/nx-match.c

  Log Message:
  -----------
  nx-match: Avoid double-free on some error paths.

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9966
Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9968
Fixes: f1eb32b9641c ("ofp-group: Fix memory leak in error cases parsing group requests.")
Signed-off-by: Ben Pfaff <blp at ovn.org>
Reviewed-by: Yifeng Sun <pkusunyifeng at gmail.com>


  Commit: 3ee9b38d5cd6c7b5dc29a5854432ffb77aa4f7db
      https://github.com/openvswitch/ovs/commit/3ee9b38d5cd6c7b5dc29a5854432ffb77aa4f7db
  Author: Ben Pfaff <blp at ovn.org>
  Date:   2018-08-30 (Thu, 30 Aug 2018)

  Changed paths:
    M lib/ofp-actions.c

  Log Message:
  -----------
  ofp-actions: Re-fix error path for parsing OpenFlow actions.

A previous commit attempted to fix the error path when the actions nested
within clone provoked an error.  However, this commit just introduced a new
problem in another case, since it made ofpacts_pull_openflow_actions__()
restore a previously valid pointer to data that might have been
reallocated.

This commit takes another approach.  Instead of trying to restore anything
at all, it just defines ofpacts_pull_openflow_actions__() to clear the
output buffer when there's an error.  It seems that this is less error
prone.  Most of the callers don't care; this commit fixes up the ones that
do.

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9975
Fixes: 20cdd1dbd546 ("ofp-actions: Avoid assertion failure for clone(ct(...bad actions...)).")
Signed-off-by: Ben Pfaff <blp at ovn.org>
Tested-by: Yifeng Sun <pkusunyifeng at gmail.com>
Reviewed-by: Yifeng Sun <pkusunyifeng at gmail.com>


Compare: https://github.com/openvswitch/ovs/compare/3988f56ac4f2...3ee9b38d5cd6
      **NOTE:** This service has been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.


More information about the git mailing list