From 9d7680033e5d79b69b11aa768718008fc21cb134 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Thu, 24 Jan 2013 13:39:23 -0800 Subject: [PATCH] meta-flow: Avoid null pointer dereference in mf_format_frag_string(). The 'maskp' parameter to this function can be NULL, but the function always dereferenced it. This commit fixes the problem. This commit also fixes the order in which the value and mask were adjusted to correctly discard 1-bits outside of FLOW_NW_FRAG_MASK. Found by Coverity. Signed-off-by: Ben Pfaff Acked-by: Ethan Jackson --- lib/meta-flow.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/lib/meta-flow.c b/lib/meta-flow.c index e6cc196ab..2607d1287 100644 --- a/lib/meta-flow.c +++ b/lib/meta-flow.c @@ -2243,15 +2243,12 @@ mf_format_integer_string(const struct mf_field *mf, const uint8_t *valuep, } static void -mf_format_frag_string(const uint8_t *valuep, const uint8_t *maskp, - struct ds *s) +mf_format_frag_string(uint8_t value, uint8_t mask, struct ds *s) { const struct frag_handling *h; - uint8_t value = *valuep; - uint8_t mask = *maskp; - value &= mask; mask &= FLOW_NW_FRAG_MASK; + value &= mask; for (h = all_frags; h < &all_frags[ARRAY_SIZE(all_frags)]; h++) { if (value == h->value && mask == h->mask) { @@ -2310,7 +2307,7 @@ mf_format(const struct mf_field *mf, break; case MFS_FRAG: - mf_format_frag_string(&value->u8, &mask->u8, s); + mf_format_frag_string(value->u8, mask ? mask->u8 : UINT8_MAX, s); break; case MFS_TNL_FLAGS: -- 2.20.1