DPDK patches and discussions
 help / color / mirror / Atom feed
From: Michal Jastrzebski <michalx.k.jastrzebski@intel.com>
To: cristian.dumitrescu@intel.com, roy.fan.zhang@intel.com,
	jasvinder.singh@intel.com
Cc: dev@dpdk.org, Slawomir Mrozowicz <slawomirx.mrozowicz@intel.com>
Subject: [dpdk-dev] [PATCH v2] examples/qos_sched: fix out-of-bounds read
Date: Thu, 21 Apr 2016 13:47:36 +0200	[thread overview]
Message-ID: <1461239256-8104-5-git-send-email-michalx.k.jastrzebski@intel.com> (raw)
In-Reply-To: <1461239256-8104-1-git-send-email-michalx.k.jastrzebski@intel.com>

From: Slawomir Mrozowicz <slawomirx.mrozowicz@intel.com>

Fix issue reported by Coverity.

Coverity ID 30708: Out-of-bounds read
overrun-local: Overrunning array tokens of 8 8-byte elements
at element index 4294967294 (byte offset 34359738352)
using index i (which evaluates to 4294967294).

Fixes: de3cfa2c9823 ("sched: initial import")

Signed-off-by: Slawomir Mrozowicz <slawomirx.mrozowicz@intel.com>
---
 examples/qos_sched/args.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/examples/qos_sched/args.c b/examples/qos_sched/args.c
index 3e7fd08..d819269 100644
--- a/examples/qos_sched/args.c
+++ b/examples/qos_sched/args.c
@@ -175,9 +175,11 @@ app_parse_opt_vals(const char *conf_str, char separator, uint32_t n_vals, uint32
 
 	n_tokens = rte_strsplit(string, strnlen(string, 32), tokens, n_vals, separator);
 
-	for(i = 0; i < n_tokens; i++) {
+	if (n_tokens > MAX_OPT_VALUES)
+		return -1;
+
+	for (i = 0; i < n_tokens; i++)
 		opt_vals[i] = (uint32_t)atol(tokens[i]);
-	}
 
 	free(string);
 
-- 
1.9.1

  reply	other threads:[~2016-04-21 11:48 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-04-21 11:47 [dpdk-dev] [PATCH v2] examples/qos_meter: fix unchecked return value Michal Jastrzebski
2016-04-21 11:47 ` Michal Jastrzebski [this message]
2016-04-28 10:59   ` [dpdk-dev] [PATCH v2] examples/qos_sched: fix out-of-bounds read Dumitrescu, Cristian
2016-05-16 15:35     ` Thomas Monjalon
     [not found] ` <1461239256-8104-3-git-send-email-michalx.k.jastrzebski@intel.com>
2016-04-28 10:58   ` [dpdk-dev] [PATCH v2] examples/qos_sched: fix copy-paste error Dumitrescu, Cristian
     [not found] ` <1461239256-8104-4-git-send-email-michalx.k.jastrzebski@intel.com>
2016-04-28 10:58   ` [dpdk-dev] [PATCH v2] examples/qos_sched: fix negative loop bound Dumitrescu, Cristian
2016-04-28 11:22 ` [dpdk-dev] [PATCH v2] examples/qos_meter: fix unchecked return value Dumitrescu, Cristian

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1461239256-8104-5-git-send-email-michalx.k.jastrzebski@intel.com \
    --to=michalx.k.jastrzebski@intel.com \
    --cc=cristian.dumitrescu@intel.com \
    --cc=dev@dpdk.org \
    --cc=jasvinder.singh@intel.com \
    --cc=roy.fan.zhang@intel.com \
    --cc=slawomirx.mrozowicz@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).