[PATCH] app/testpmd: add size validation to token parsers

[PATCH] app/testpmd: add size validation to token parsers

[Gregory Etelson]

parse_prefix(), parse_int(), parse_mac_addr(),
parse_ipv4_addr() and parse_ipv6_addr() unconditionally overwrite
the `size` parameter with token size.
The `size` parameter references a buffer where the parser functions
will store their result.

If the `size` value was less than token size, parser will corrupt
memory outsite of target buffer.

The patch adds sizes validation.

Fixes: d3f61b7bad20 ("app/testpmd: add flow item spec prefix length")
Fixes: 8a03ab58cc0a ("app/testpmd: support flow integer")
Fixes: 6df81b325fa4 ("app/testpmd: add items eth/vlan to flow command")
Fixes: ef6e38550f07 ("app/testpmd: add items ipv4/ipv6 to flow command")

Cc: stable@dpdk.org
Signed-off-by: Gregory Etelson <getelson@nvidia.com>
---
 app/test-pmd/cmdline_flow.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/app/test-pmd/cmdline_flow.c b/app/test-pmd/cmdline_flow.c
index ce71818705..87541d2c46 100644
--- a/app/test-pmd/cmdline_flow.c
+++ b/app/test-pmd/cmdline_flow.c
@@ -7715,6 +7715,8 @@ parse_prefix(struct context *ctx, const struct token *token,
 	}
 	bytes = u / 8;
 	extra = u % 8;
+	if (size < arg->size)
+		goto error;
 	size = arg->size;
 	if (bytes > size || bytes + !!extra > size)
 		goto error;
@@ -10806,6 +10808,8 @@ parse_int(struct context *ctx, const struct token *token,
 		return len;
 	}
 	buf = (uint8_t *)ctx->object + arg->offset;
+	if (size < arg->size)
+		goto error;
 	size = arg->size;
 	if (u > RTE_LEN2MASK(size * CHAR_BIT, uint64_t))
 		return -1;
@@ -11093,6 +11097,8 @@ parse_mac_addr(struct context *ctx, const struct token *token,
 	/* Argument is expected. */
 	if (!arg)
 		return -1;
+	if (size < arg->size)
+		goto error;
 	size = arg->size;
 	/* Bit-mask fill is not supported. */
 	if (arg->mask || size != sizeof(tmp))
@@ -11134,6 +11140,8 @@ parse_ipv4_addr(struct context *ctx, const struct token *token,
 	/* Argument is expected. */
 	if (!arg)
 		return -1;
+	if (size < arg->size)
+		goto error;
 	size = arg->size;
 	/* Bit-mask fill is not supported. */
 	if (arg->mask || size != sizeof(tmp))
@@ -11181,6 +11189,8 @@ parse_ipv6_addr(struct context *ctx, const struct token *token,
 	/* Argument is expected. */
 	if (!arg)
 		return -1;
+	if (size < arg->size)
+		goto error;
 	size = arg->size;
 	/* Bit-mask fill is not supported. */
 	if (arg->mask || size != sizeof(tmp))
-- 
2.39.2

Re: [PATCH] app/testpmd: add size validation to token parsers

[Ferruh Yigit]

On 11/11/2023 7:13 AM, Gregory Etelson wrote:
> parse_prefix(), parse_int(), parse_mac_addr(),
> parse_ipv4_addr() and parse_ipv6_addr() unconditionally overwrite
> the `size` parameter with token size.
> The `size` parameter references a buffer where the parser functions
> will store their result.
> 
> If the `size` value was less than token size, parser will corrupt
> memory outsite of target buffer.
> 
> The patch adds sizes validation.
> 
> Fixes: d3f61b7bad20 ("app/testpmd: add flow item spec prefix length")
> Fixes: 8a03ab58cc0a ("app/testpmd: support flow integer")
> Fixes: 6df81b325fa4 ("app/testpmd: add items eth/vlan to flow command")
> Fixes: ef6e38550f07 ("app/testpmd: add items ipv4/ipv6 to flow command")
> Cc: stable@dpdk.org
>
> Signed-off-by: Gregory Etelson <getelson@nvidia.com>
>

Acked-by: Ferruh Yigit <ferruh.yigit@amd.com>

Applied to dpdk-next-net/main, thanks.

Re: [PATCH] app/testpmd: add size validation to token parsers

[Ferruh Yigit]

On 2/8/2024 2:45 PM, Ferruh Yigit wrote:
> On 11/11/2023 7:13 AM, Gregory Etelson wrote:
>> parse_prefix(), parse_int(), parse_mac_addr(),
>> parse_ipv4_addr() and parse_ipv6_addr() unconditionally overwrite
>> the `size` parameter with token size.
>> The `size` parameter references a buffer where the parser functions
>> will store their result.
>>
>> If the `size` value was less than token size, parser will corrupt
>> memory outsite of target buffer.
>>
>> The patch adds sizes validation.
>>
>> Fixes: d3f61b7bad20 ("app/testpmd: add flow item spec prefix length")
>> Fixes: 8a03ab58cc0a ("app/testpmd: support flow integer")
>> Fixes: 6df81b325fa4 ("app/testpmd: add items eth/vlan to flow command")
>> Fixes: ef6e38550f07 ("app/testpmd: add items ipv4/ipv6 to flow command")
>> Cc: stable@dpdk.org
>>
>> Signed-off-by: Gregory Etelson <getelson@nvidia.com>
>>
> 
> Acked-by: Ferruh Yigit <ferruh.yigit@amd.com>
> 
> Applied to dpdk-next-net/main, thanks.
>

Dropped from tree, because of issue reported in following thread:
https://inbox.dpdk.org/dev/4dfd536b-4f57-4d56-b864-a7c42c0fd746@amd.com/T/#m051054336b924b82aa34e2fb06ab7dd6fbb69ea5

Updated patchwork as rejected.