ofproto-dpif: Fix use-after-free error in handle_miss_upcalls().

[sliver-openvswitch.git] / lib / bundle.c

diff --git a/lib/bundle.c b/lib/bundle.c
index 86762f9..5db97d3 100644 (file)
--- a/lib/bundle.c
+++ b/lib/bundle.c
@@ -152,8 +152,8 @@ bundle_check(const struct nx_action_bundle *nab, int max_ports,
             VLOG_WARN_RL(&rl, "bundle_load action requires at least 16 bit "
                          "destination.");
             error = ofp_mkerr(OFPET_BAD_ACTION, OFPBAC_BAD_ARGUMENT);
-        } else {
-            error = nxm_dst_check(nab->dst, ofs, n_bits, flow) || error;
+        } else if (!error) {
+            error = nxm_dst_check(nab->dst, ofs, n_bits, flow);
         }
     }
 
@@ -193,6 +193,7 @@ bundle_parse__(struct ofpbuf *b, const char *s, char **save_ptr,
                const char *slave_type, const char *dst,
                const char *slave_delim)
 {
+    enum ofputil_action_code code;
     struct nx_action_bundle *nab;
     uint16_t n_slaves;
 
@@ -205,14 +206,15 @@ bundle_parse__(struct ofpbuf *b, const char *s, char **save_ptr,
                    s, slave_delim);
     }
 
-    b->l2 = ofpbuf_put_zeros(b, sizeof *nab);
+    code = dst ? OFPUTIL_NXAST_BUNDLE_LOAD : OFPUTIL_NXAST_BUNDLE;
+    b->l2 = ofputil_put_action(code, b);
 
     n_slaves = 0;
     for (;;) {
         ovs_be16 slave_be;
         char *slave;
 
-        slave = strtok_r(NULL, ", ", save_ptr);
+        slave = strtok_r(NULL, ", [", save_ptr);
         if (!slave || n_slaves >= BUNDLE_MAX_SLAVES) {
             break;
         }
@@ -229,10 +231,7 @@ bundle_parse__(struct ofpbuf *b, const char *s, char **save_ptr,
     }
 
     nab = b->l2;
-    nab->type = htons(OFPAT_VENDOR);
     nab->len = htons(b->size - ((char *) b->l2 - (char *) b->data));
-    nab->vendor = htonl(NX_VENDOR_ID);
-    nab->subtype = htons(dst ? NXAST_BUNDLE_LOAD: NXAST_BUNDLE);
     nab->n_slaves = htons(n_slaves);
     nab->basis = htons(atoi(basis));