ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mpls: fix header offset overflow

Browse Source 
rw_len (MPLS rewrite string length) is declared as unsigned but is used
as -rw_len with vlib_buffer_advance(), resulting in a wrong, huge
offset.

Type: fix
Fixes: 734d430f37251bc7e71d507983ee640ae1625fbe
Ticket: VPP-1705
Change-Id: I7357249f7e50b7d30fd61f5be4858a26e43df85d
Signed-off-by: Benoît Ganne <bganne@cisco.com>
This commit is contained in:
Benoît Ganne
2019-06-17 14:42:47 +02:00
committed by Neale Ranns
parent f867cf1656
commit c257e07621
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/vnet/mpls/mpls_output.c
View File

@ -78,12 +78,14 @@ mpls_output_inline (vlib_main_t * vm,
ip_adjacency_t * adj0;
mpls_unicast_header_t *hdr0;
vlib_buffer_t * p0;
u32 pi0, rw_len0, adj_index0, next0, error0;
u32 pi0, adj_index0, next0, error0;
word rw_len0;
ip_adjacency_t * adj1;
mpls_unicast_header_t *hdr1;
vlib_buffer_t * p1;
u32 pi1, rw_len1, adj_index1, next1, error1;
u32 pi1, adj_index1, next1, error1;
word rw_len1;
/* Prefetch next iteration. */
{
@ -221,7 +223,8 @@ mpls_output_inline (vlib_main_t * vm,
ip_adjacency_t * adj0;
mpls_unicast_header_t *hdr0;
vlib_buffer_t * p0;
u32 pi0, rw_len0, adj_index0, next0, error0;
u32 pi0, adj_index0, next0, error0;
word rw_len0;
pi0 = to_next[0] = from[0];