ofproto-dpif-upcall: Avoid use-after-free in revalidate() corner cases.
authorBen Pfaff <blp@nicira.com>
Thu, 15 May 2014 22:52:17 +0000 (15:52 -0700)
committerBen Pfaff <blp@nicira.com>
Thu, 15 May 2014 22:55:55 +0000 (15:55 -0700)
commit1340ce0c17562e3b0af6c6c117d43bc93372ee79
treec5248f0fead3502d852f6e29f628636e4af701a1
parent920dfb2a4a2608a4989cfa146b01bc297659add1
ofproto-dpif-upcall: Avoid use-after-free in revalidate() corner cases.

The loop in revalidate() needs to ensure that any data obtained from
dpif_flow_dump_next() is used before it is destroyed, as indicated by
dpif_flow_dump_next_may_destroy_keys().  In the common case, where
processing reaches the end of the main "while" loop, it does this, but
in two corner cases the code in the loop execute "continue;", which skipped
the check.  This commit fixes the problem.

Bug #1249988.
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>
ofproto/ofproto-dpif-upcall.c