From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by dpdk.org (Postfix) with ESMTP id 552354CE4 for ; Thu, 21 Apr 2016 13:48:13 +0200 (CEST) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga104.fm.intel.com with ESMTP; 21 Apr 2016 04:48:13 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.24,512,1455004800"; d="scan'208";a="963460637" Received: from pczapiex-mobl.ger.corp.intel.com (HELO Sent) ([10.217.248.212]) by fmsmga002.fm.intel.com with SMTP; 21 Apr 2016 04:48:10 -0700 Received: by Sent (sSMTP sendmail emulation); Thu, 21 Apr 2016 13:48:09 +0200 From: Michal Jastrzebski To: cristian.dumitrescu@intel.com, roy.fan.zhang@intel.com, jasvinder.singh@intel.com Cc: dev@dpdk.org, Slawomir Mrozowicz Date: Thu, 21 Apr 2016 13:47:36 +0200 Message-Id: <1461239256-8104-5-git-send-email-michalx.k.jastrzebski@intel.com> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1461239256-8104-1-git-send-email-michalx.k.jastrzebski@intel.com> References: <1461239256-8104-1-git-send-email-michalx.k.jastrzebski@intel.com> Subject: [dpdk-dev] [PATCH v2] examples/qos_sched: fix out-of-bounds read X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Apr 2016 11:48:13 -0000 From: Slawomir Mrozowicz Fix issue reported by Coverity. Coverity ID 30708: Out-of-bounds read overrun-local: Overrunning array tokens of 8 8-byte elements at element index 4294967294 (byte offset 34359738352) using index i (which evaluates to 4294967294). Fixes: de3cfa2c9823 ("sched: initial import") Signed-off-by: Slawomir Mrozowicz --- examples/qos_sched/args.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/examples/qos_sched/args.c b/examples/qos_sched/args.c index 3e7fd08..d819269 100644 --- a/examples/qos_sched/args.c +++ b/examples/qos_sched/args.c @@ -175,9 +175,11 @@ app_parse_opt_vals(const char *conf_str, char separator, uint32_t n_vals, uint32 n_tokens = rte_strsplit(string, strnlen(string, 32), tokens, n_vals, separator); - for(i = 0; i < n_tokens; i++) { + if (n_tokens > MAX_OPT_VALUES) + return -1; + + for (i = 0; i < n_tokens; i++) opt_vals[i] = (uint32_t)atol(tokens[i]); - } free(string); -- 1.9.1