From 81bec2c9bc5362597950058cdbf6b0165f84a92d Mon Sep 17 00:00:00 2001 From: William Tu Date: Fri, 4 Mar 2016 18:00:46 -0800 Subject: [PATCH] ofpbuf: Fix use-after-free in bundle parse. Address pointed by bundle could be obsolete/free'd when realloc, called from ofpbuf_put_zero(), returns new address. Reported by Valgrind 367: ovs-ofctl parse-flows (NXM) Invalid write of size 4 bundle_parse__ (bundle.c:200) bundle_parse_load (bundle.c:272) parse_bundle_load (ofp-actions.c:1324) ofpacts_parse__ (ofp-actions.c:7484) ofpacts_parse (ofp-actions.c:7540) ofpacts_parse_copy (ofp-actions.c:7558) parse_ofp_str__ (ofp-parse.c:491) parse_ofp_str (ofp-parse.c:544) parse_ofp_flow_mod_str (ofp-parse.c:870) Address 0x7a4e96c is 12 bytes inside a block of size 64 free'd free (vg_replace_malloc.c:530) ofpbuf_resize__ (ofpbuf.c:246) (purposely add to force using new buf) ofpbuf_put_zeros (ofpbuf.c:375) bundle_parse__ (bundle.c:181) bundle_parse_load (bundle.c:272) parse_bundle_load (ofp-actions.c:1324) ofpacts_parse__ (ofp-actions.c:7484) ofpacts_parse (ofp-actions.c:7540) ofpacts_parse_copy (ofp-actions.c:7558) Signed-off-by: William Tu Signed-off-by: Joe Stringer --- lib/bundle.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/bundle.c b/lib/bundle.c index 871a724e8..1451e928f 100644 --- a/lib/bundle.c +++ b/lib/bundle.c @@ -180,6 +180,7 @@ bundle_parse__(const char *s, char **save_ptr, } ofpact_finish(ofpacts, &bundle->ofpact); + bundle = ofpacts->header; bundle->basis = atoi(basis); if (!strcasecmp(fields, "eth_src")) { -- 2.20.1