Re: [dpdk-dev] [PATCH] i40e: fix the issue reported by klocwork

[Thomas Monjalon <thomas.monjalon@6wind.com>]

Helin, is this patch valid and important?

2015-02-12 19:22, Jingjing Wu:
> Klocwork reports array 'src_offset' may use index 16.
> In function i40e_srcoff_to_flx_pit, index j + 1 can reach I40E_FDIR_MAX_FLEX_LEN.
> This patch fixes this issue to avoid array bound.
> 
> Signed-off-by: Jingjing Wu <jingjing.wu@intel.com>
> ---
>  lib/librte_pmd_i40e/i40e_fdir.c | 35 +++++++++++++++++------------------
>  1 file changed, 17 insertions(+), 18 deletions(-)
> 
> diff --git a/lib/librte_pmd_i40e/i40e_fdir.c b/lib/librte_pmd_i40e/i40e_fdir.c
> index 68511c8..bc36d8e 100644
> --- a/lib/librte_pmd_i40e/i40e_fdir.c
> +++ b/lib/librte_pmd_i40e/i40e_fdir.c
> @@ -402,28 +402,27 @@ i40e_srcoff_to_flx_pit(const uint16_t *src_offset,
>  
>  	while (j < I40E_FDIR_MAX_FLEX_LEN) {
>  		size = 1;
> -		for (; j < I40E_FDIR_MAX_FLEX_LEN; j++) {
> +		for (; j < I40E_FDIR_MAX_FLEX_LEN - 1; j++) {
>  			if (src_offset[j + 1] == src_offset[j] + 1)
>  				size++;
> -			else {
> -				src_tmp = src_offset[j] + 1 - size;
> -				/* the flex_pit need to be sort by scr_offset */
> -				for (i = 0; i < num; i++) {
> -					if (src_tmp < flex_pit[i].src_offset)
> -						break;
> -				}
> -				/* if insert required, move backward */
> -				for (k = num; k > i; k--)
> -					flex_pit[k] = flex_pit[k - 1];
> -				/* insert */
> -				flex_pit[i].dst_offset = j + 1 - size;
> -				flex_pit[i].src_offset = src_tmp;
> -				flex_pit[i].size = size;
> -				j++;
> -				num++;
> +			else
> +				break;
> +		}
> +		src_tmp = src_offset[j] + 1 - size;
> +		/* the flex_pit need to be sort by src_offset */
> +		for (i = 0; i < num; i++) {
> +			if (src_tmp < flex_pit[i].src_offset)
>  				break;
> -			}
>  		}
> +		/* if insert required, move backward */
> +		for (k = num; k > i; k--)
> +			flex_pit[k] = flex_pit[k - 1];
> +		/* insert */
> +		flex_pit[i].dst_offset = j + 1 - size;
> +		flex_pit[i].src_offset = src_tmp;
> +		flex_pit[i].size = size;
> +		j++;
> +		num++;
>  	}
>  	return num;
>  }
>