File 0001-ofp-util-Fix-memory-leaks-when-parsing-OF1... of Package openvswitch.6197

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-ofp-util-Fix-memory-leaks-when-parsing-OF1.5-group-p.patch of Package openvswitch.6197

From 6c4d1c667ed40d752aca33a7f989afed5291171e Mon Sep 17 00:00:00 2001
From: Ben Pfaff <blp@ovn.org>
Date: Thu, 21 Sep 2017 09:59:58 -0700
Subject: [PATCH] ofp-util: Fix memory leaks when parsing OF1.5 group
 properties.

Found by libFuzzer.

Reported-by: Bhargava Shastry <bshastry@sec.t-labs.tu-berlin.de>
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Justin Pettit <jpettit@ovn.org>
---
 lib/ofp-util.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/ofp-util.c b/lib/ofp-util.c
index c28d7bf68..cbe1472c5 100644
--- a/lib/ofp-util.c
+++ b/lib/ofp-util.c
@@ -8531,8 +8531,13 @@ ofputil_decode_ofp15_group_desc_reply(struct ofputil_group_desc *gd,
      * Such properties are valid for group desc replies so
      * claim that the group mod command is OFPGC15_ADD to
      * satisfy the check in parse_group_prop_ntr_selection_method() */
-    return parse_ofp15_group_properties(msg, gd->type, OFPGC15_ADD, &gd->props,
-                                        length - sizeof *ogds - bucket_list_len);
+    error = parse_ofp15_group_properties(
+        msg, gd->type, OFPGC15_ADD, &gd->props,
+        length - sizeof *ogds - bucket_list_len);
+    if (error) {
+        ofputil_bucket_list_destroy(&gd->buckets);
+    }
+    return error;
 }
 
 /* Converts a group description reply in 'msg' into an abstract
@@ -8823,8 +8828,12 @@ ofputil_pull_ofp15_group_mod(struct ofpbuf *msg, enum ofp_version ofp_version,
         return error;
     }
 
-    return parse_ofp15_group_properties(msg, gm->type, gm->command, &gm->props,
-                                        msg->size);
+    error = parse_ofp15_group_properties(msg, gm->type, gm->command,
+                                         &gm->props, msg->size);
+    if (error) {
+        ofputil_bucket_list_destroy(&gm->buckets);
+    }
+    return error;
 }
 
 /* Converts OpenFlow group mod message 'oh' into an abstract group mod in
-- 
2.15.0

Places

File 0001-ofp-util-Fix-memory-leaks-when-parsing-OF1.5-group-p.patch of Package openvswitch.6197

Places