ofp-util: Avoid misaligned memory access in ofputil_encode_packet_in().

Reported-by: Murphy McCauley <murphy.mccauley@gmail.com>

diff --git a/AUTHORS b/AUTHORS
index 294b228..b80bfdf 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -79,6 +79,7 @@ Krishna Miriyala        krishna@nicira.com
 Luiz Henrique Ozaki     luiz.ozaki@gmail.com
 Michael Hu              mhu@nicira.com
 Michael Mao             mmao@nicira.com
+Murphy McCauley         murphy.mccauley@gmail.com
 Mikael Doverhag         mdoverhag@nicira.com
 Niklas Andersson        nandersson@nicira.com
 Pankaj Thakkar          thakkar@nicira.com

diff --git a/lib/ofp-util.c b/lib/ofp-util.c
index df3377a..9add607 100644 (file)
--- a/lib/ofp-util.c
+++ b/lib/ofp-util.c
@@ -1457,7 +1457,7 @@ ofputil_encode_packet_in(const struct ofputil_packet_in *pin,
                         struct ofpbuf *rw_packet)
 {
     int total_len = pin->packet->size;
-    struct ofp_packet_in *opi;
+    struct ofp_packet_in opi;
 
     if (rw_packet) {
         if (pin->send_len < rw_packet->size) {
@@ -1470,13 +1470,14 @@ ofputil_encode_packet_in(const struct ofputil_packet_in *pin,
     }
 
     /* Add OFPT_PACKET_IN. */
-    opi = ofpbuf_push_zeros(rw_packet, offsetof(struct ofp_packet_in, data));
-    opi->header.version = OFP_VERSION;
-    opi->header.type = OFPT_PACKET_IN;
-    opi->total_len = htons(total_len);
-    opi->in_port = htons(pin->in_port);
-    opi->reason = pin->reason;
-    opi->buffer_id = htonl(pin->buffer_id);
+    memset(&opi, 0, sizeof opi);
+    opi.header.version = OFP_VERSION;
+    opi.header.type = OFPT_PACKET_IN;
+    opi.total_len = htons(total_len);
+    opi.in_port = htons(pin->in_port);
+    opi.reason = pin->reason;
+    opi.buffer_id = htonl(pin->buffer_id);
+    ofpbuf_push(rw_packet, &opi, offsetof(struct ofp_packet_in, data));
     update_openflow_length(rw_packet);
 
     return rw_packet;