ofpbuf: Fix use-after-free in bundle parse.

[cascardo/ovs.git] / lib / bundle.c

diff --git a/lib/bundle.c b/lib/bundle.c
index e66ceed..1451e92 100644 (file)
--- a/lib/bundle.c
+++ b/lib/bundle.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011, 2012, 2013, 2014 Nicira, Inc.
+/* Copyright (c) 2011, 2012, 2013, 2014, 2015 Nicira, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -117,14 +117,14 @@ bundle_check(const struct ofpact_bundle *bundle, ofp_port_t max_ports,
 
     for (i = 0; i < bundle->n_slaves; i++) {
         ofp_port_t ofp_port = bundle->slaves[i];
-        enum ofperr error;
 
-        error = ofpact_check_output_port(ofp_port, max_ports);
-        if (error) {
-            VLOG_WARN_RL(&rl, "invalid slave %"PRIu16, ofp_port);
-            return error;
+        if (ofp_port != OFPP_NONE) {
+            enum ofperr error = ofpact_check_output_port(ofp_port, max_ports);
+            if (error) {
+                VLOG_WARN_RL(&rl, "invalid slave %"PRIu16, ofp_port);
+                return error;
+            }
         }
-
         /* Controller slaves are unsupported due to the lack of a max_len
          * argument. This may or may not change in the future.  There doesn't
          * seem to be a real-world use-case for supporting it. */
@@ -175,17 +175,22 @@ bundle_parse__(const char *s, char **save_ptr,
         }
         ofpbuf_put(ofpacts, &slave_port, sizeof slave_port);
 
-        bundle = ofpacts->frame;
+        bundle = ofpacts->header;
         bundle->n_slaves++;
     }
-    ofpact_update_len(ofpacts, &bundle->ofpact);
+    ofpact_finish(ofpacts, &bundle->ofpact);
 
+    bundle = ofpacts->header;
     bundle->basis = atoi(basis);
 
     if (!strcasecmp(fields, "eth_src")) {
         bundle->fields = NX_HASH_FIELDS_ETH_SRC;
     } else if (!strcasecmp(fields, "symmetric_l4")) {
         bundle->fields = NX_HASH_FIELDS_SYMMETRIC_L4;
+    } else if (!strcasecmp(fields, "symmetric_l3l4")) {
+        bundle->fields = NX_HASH_FIELDS_SYMMETRIC_L3L4;
+    } else if (!strcasecmp(fields, "symmetric_l3l4+udp")) {
+        bundle->fields = NX_HASH_FIELDS_SYMMETRIC_L3L4_UDP;
     } else {
         return xasprintf("%s: unknown fields `%s'", s, fields);
     }