From e18ab84ffeb07d49b0839598005a19a1e6d3920b Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Tue, 31 Dec 2013 11:32:16 -0800 Subject: [PATCH] odp-util: Avoid null dereference in parse_8021q_onward(). For parsing a mask, this code in parse_8021q_onward() always read out the OVS_KEY_ATTR_VLAN attribute without first checking whether it existed. The correct behavior, implemented by this commit, appears to be treating the VLAN as wildcarded and to continue parsing the flow. Bug #22312. Reported-by: Krishna Miriyala Signed-off-by: Ben Pfaff Acked-by: Justin Pettit --- lib/odp-util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/odp-util.c b/lib/odp-util.c index f44c7d49d..18ad5c67f 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -3035,7 +3035,9 @@ parse_8021q_onward(const struct nlattr *attrs[OVS_KEY_ATTR_MAX + 1], if (!is_mask && !(present_attrs & (UINT64_C(1) << OVS_KEY_ATTR_VLAN))) { return ODP_FIT_TOO_LITTLE; } else { - tci = nl_attr_get_be16(attrs[OVS_KEY_ATTR_VLAN]); + tci = (present_attrs & (UINT64_C(1) << OVS_KEY_ATTR_VLAN) + ? nl_attr_get_be16(attrs[OVS_KEY_ATTR_VLAN]) + : htons(0)); if (!is_mask) { if (tci == htons(0)) { /* Corner case for a truncated 802.1Q header. */ -- 2.20.1