From: "Min Hu (Connor)" <humin29@huawei.com>
To: <dev@dpdk.org>
Cc: <ferruh.yigit@intel.com>, <jerinj@marvell.com>, <thomas@monjalon.net>
Subject: [dpdk-dev] [PATCH] app/testeventdev: fix buffer overflow
Date: Fri, 23 Apr 2021 15:38:08 +0800 [thread overview]
Message-ID: <1619163488-63913-1-git-send-email-humin29@huawei.com> (raw)
Tainted and unvalidated integer 'idx' used as an index, which may
lead to buffer overflow.
This patch fixed it.
Fixes: 89e5eb118017 ("app/testeventdev: add string parsing helpers")
Cc: stable@dpdk.org
Signed-off-by: Min Hu (Connor) <humin29@huawei.com>
---
app/test-eventdev/evt_options.c | 4 ++--
app/test-eventdev/parser.c | 6 ++++--
app/test-eventdev/parser.h | 2 +-
3 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/app/test-eventdev/evt_options.c b/app/test-eventdev/evt_options.c
index 0d55405..061b63e 100644
--- a/app/test-eventdev/evt_options.c
+++ b/app/test-eventdev/evt_options.c
@@ -221,7 +221,7 @@ evt_parse_plcores(struct evt_options *opt, const char *corelist)
{
int ret;
- ret = parse_lcores_list(opt->plcores, corelist);
+ ret = parse_lcores_list(opt->plcores, RTE_MAX_LCORE, corelist);
if (ret == -E2BIG)
evt_err("duplicate lcores in plcores");
@@ -233,7 +233,7 @@ evt_parse_work_lcores(struct evt_options *opt, const char *corelist)
{
int ret;
- ret = parse_lcores_list(opt->wlcores, corelist);
+ ret = parse_lcores_list(opt->wlcores, RTE_MAX_LCORE, corelist);
if (ret == -E2BIG)
evt_err("duplicate lcores in wlcores");
diff --git a/app/test-eventdev/parser.c b/app/test-eventdev/parser.c
index 24f1855..7a973cb 100644
--- a/app/test-eventdev/parser.c
+++ b/app/test-eventdev/parser.c
@@ -310,7 +310,7 @@ parse_hex_string(char *src, uint8_t *dst, uint32_t *size)
}
int
-parse_lcores_list(bool lcores[], const char *corelist)
+parse_lcores_list(bool lcores[], int lcores_num, const char *corelist)
{
int i, idx = 0;
int min, max;
@@ -332,6 +332,8 @@ parse_lcores_list(bool lcores[], const char *corelist)
if (*corelist == '\0')
return -1;
idx = strtoul(corelist, &end, 10);
+ if (idx < 0 || idx > lcores_num)
+ return -1;
if (end == NULL)
return -1;
@@ -343,7 +345,7 @@ parse_lcores_list(bool lcores[], const char *corelist)
max = idx;
if (min == RTE_MAX_LCORE)
min = idx;
- for (idx = min; idx <= max; idx++) {
+ for (idx = min; idx < max; idx++) {
if (lcores[idx] == 1)
return -E2BIG;
lcores[idx] = 1;
diff --git a/app/test-eventdev/parser.h b/app/test-eventdev/parser.h
index 673ff22..696b40a 100644
--- a/app/test-eventdev/parser.h
+++ b/app/test-eventdev/parser.h
@@ -46,5 +46,5 @@ int parse_hex_string(char *src, uint8_t *dst, uint32_t *size);
int parse_tokenize_string(char *string, char *tokens[], uint32_t *n_tokens);
-int parse_lcores_list(bool lcores[], const char *corelist);
+int parse_lcores_list(bool lcores[], int lcores_num, const char *corelist);
#endif
--
2.7.4
next reply other threads:[~2021-04-23 7:38 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-23 7:38 Min Hu (Connor) [this message]
2021-04-23 9:08 ` [dpdk-dev] [EXT] " Pavan Nikhilesh Bhagavatula
2021-04-29 8:11 ` Jerin Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1619163488-63913-1-git-send-email-humin29@huawei.com \
--to=humin29@huawei.com \
--cc=dev@dpdk.org \
--cc=ferruh.yigit@intel.com \
--cc=jerinj@marvell.com \
--cc=thomas@monjalon.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).