diff options
| author | Reyk Floeter <reyk@cvs.openbsd.org> | 2017-08-11 13:56:07 +0000 |
|---|---|---|
| committer | Reyk Floeter <reyk@cvs.openbsd.org> | 2017-08-11 13:56:07 +0000 |
| commit | 9b11e7b0a70745eeab66b5620b24c8ccde036380 (patch) | |
| tree | b5ac9a12e1f5eb46ff302098133bd2b571866cef /sys/net | |
| parent | c866e474a36777a21e01a563648ca4c22e0775e5 (diff) | |
Fix out-of-bounds read when looking up the flow-mod handler.
Another case of the "C indexes start at 0" bug where ">" must be ">=":
if (i >= nitems(foo))
return (NULL);
else
return (foo[i].handler);
Coverity CID 1453340; Severity: Major
OK millert@ goda@
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/switchofp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net/switchofp.c b/sys/net/switchofp.c index e6321a517b2..c9da7d77c74 100644 --- a/sys/net/switchofp.c +++ b/sys/net/switchofp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: switchofp.c,v 1.68 2017/08/11 13:55:09 reyk Exp $ */ +/* $OpenBSD: switchofp.c,v 1.69 2017/08/11 13:56:06 reyk Exp $ */ /* * Copyright (c) 2016 Kazuya GODA <goda@openbsd.org> @@ -5346,7 +5346,7 @@ swofp_flow_mod_cmd_delete_strict(struct switch_softc *sc, struct mbuf *m) ofp_msg_handler * swofp_flow_mod_lookup_handler(uint8_t cmd) { - if (cmd > nitems(ofp_flow_mod_table)) + if (cmd >= nitems(ofp_flow_mod_table)) return (NULL); else return (&ofp_flow_mod_table[cmd].ofm_cmd_handler); |