git://git.onelab.eu
/
sliver-openvswitch.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
a4fbb68
)
ovs-ofctl: Fix use-after-free error in mod-flows command.
author
Jean Tourrilhes
<jt@hpl.hp.com>
Thu, 8 Oct 2009 17:39:49 +0000
(10:39 -0700)
committer
Ben Pfaff
<blp@nicira.com>
Thu, 8 Oct 2009 17:42:14 +0000
(10:42 -0700)
utilities/ovs-ofctl.c
patch
|
blob
|
history
diff --git
a/utilities/ovs-ofctl.c
b/utilities/ovs-ofctl.c
index
04a869a
..
7611415
100644
(file)
--- a/
utilities/ovs-ofctl.c
+++ b/
utilities/ovs-ofctl.c
@@
-916,11
+916,15
@@
do_mod_flows(const struct settings *s, int argc UNUSED, char *argv[])
struct vconn *vconn;
struct ofpbuf *buffer;
struct ofp_flow_mod *ofm;
struct vconn *vconn;
struct ofpbuf *buffer;
struct ofp_flow_mod *ofm;
+ struct ofp_match match;
- /* Parse and send. */
- ofm = make_openflow(sizeof *ofm, OFPT_FLOW_MOD, &buffer);
- str_to_flow(argv[2], &ofm->match, buffer,
+ /* Parse and send. str_to_flow() will expand and reallocate the data in
+ * 'buffer', so we can't keep pointers to across the str_to_flow() call. */
+ make_openflow(sizeof *ofm, OFPT_FLOW_MOD, &buffer);
+ str_to_flow(argv[2], &match, buffer,
NULL, NULL, &priority, &idle_timeout, &hard_timeout);
NULL, NULL, &priority, &idle_timeout, &hard_timeout);
+ ofm = buffer->data;
+ ofm->match = match;
if (s->strict) {
ofm->command = htons(OFPFC_MODIFY_STRICT);
} else {
if (s->strict) {
ofm->command = htons(OFPFC_MODIFY_STRICT);
} else {