ofproto-dpif-upcall: Avoid use-after-free in revalidate() corner cases.
authorBen Pfaff <blp@nicira.com>
Thu, 15 May 2014 22:52:17 +0000 (15:52 -0700)
committerBen Pfaff <blp@nicira.com>
Thu, 15 May 2014 22:53:47 +0000 (15:53 -0700)
commita6ce4b9d2518a261f0d8f51acef069d687b8df2e
treeee880e69a3933558e957aef757274ca2aa99c8f9
parentfbf4f74d8fb9184ebeceaf8338c834bcc839943a
ofproto-dpif-upcall: Avoid use-after-free in revalidate() corner cases.

The loop in revalidate() needs to ensure that any data obtained from
dpif_flow_dump_next() is used before it is destroyed, as indicated by
dpif_flow_dump_next_may_destroy_keys().  In the common case, where
processing reaches the end of the main "while" loop, it does this, but
in two corner cases the code in the loop execute "continue;", which skipped
the check.  This commit fixes the problem.

Bug #1249988.
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>
ofproto/ofproto-dpif-upcall.c