ofproto: Fix write-after-free error in compose_nx_flow_removed().

[sliver-openvswitch.git] / ofproto / ofproto.c

diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c
index 8b52b80..5cd76df 100644 (file)
--- a/ofproto/ofproto.c
+++ b/ofproto/ofproto.c
@@ -4698,10 +4698,10 @@ compose_nx_flow_removed(const struct rule *rule, uint8_t reason)
     struct ofpbuf *buf;
     int match_len;
 
-    nfr = make_nxmsg(sizeof *nfr, NXT_FLOW_REMOVED, &buf);
+    make_nxmsg(sizeof *nfr, NXT_FLOW_REMOVED, &buf);
 
     match_len = nx_put_match(buf, &rule->cr);
-
+    nfr = buf->data;
     nfr->cookie = rule->flow_cookie;
     nfr->priority = htons(rule->cr.priority);
     nfr->reason = reason;