ofp-util: Avoid use-after-free error in ofputil_append_meter_config().

Reported-by: weizj <334965317@qq.com>
Reported-at: https://github.com/openvswitch/ovs/pull/97
Signed-off-by: Ben Pfaff <blp@ovn.org>

diff --git a/AUTHORS b/AUTHORS
index c75a77d..fc0163b 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -420,6 +420,7 @@ likunyun                kunyunli@hotmail.com
 meishengxin             meishengxin@huawei.com
 neeraj mehta            mehtaneeraj07@gmail.com
 rahim entezari          rahim.entezari@gmail.com
+weizj                   34965317@qq.com
 俊 赵                    zhaojun12@outlook.com
 冯全树(Crab)            fqs888@126.com
 胡靖飞                  hujingfei914@msn.com

diff --git a/lib/ofp-util.c b/lib/ofp-util.c
index 126b555..fd23a3a 100644 (file)
--- a/lib/ofp-util.c
+++ b/lib/ofp-util.c
@@ -2039,6 +2039,7 @@ ofputil_append_meter_config(struct ovs_list *replies,
 
     ofputil_put_bands(mc->n_bands, mc->bands, msg);
 
+    reply = ofpbuf_at_assert(msg, start_ofs, sizeof *reply);
     reply->length = htons(msg->size - start_ofs);
 
     ofpmp_postappend(replies, start_ofs);