ofp-util: Fix use-after-free in group append.

[cascardo/ovs.git] / lib / ofp-util.c

diff --git a/lib/ofp-util.c b/lib/ofp-util.c
index aae389d..11374d0 100644 (file)
--- a/lib/ofp-util.c
+++ b/lib/ofp-util.c
@@ -8364,6 +8364,7 @@ ofputil_append_ofp15_group_desc_reply(const struct ofputil_group_desc *gds,
         ofputil_put_group_prop_ntr_selection_method(version, &gds->props,
                                                     reply);
     }
+    ogds = ofpbuf_at_assert(reply, start_ogds, sizeof *ogds);
     ogds->length = htons(reply->size - start_ogds);
 
     ofpmp_postappend(replies, start_ogds);