| Message ID | 20230506065309.89052-1-chenzhiqi.123@bytedance.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [ovs-dev] dpctl: Fix dereferencing null pointer in parse_ct_limit_zones(). | expand |
On 5/6/23 08:53, Zhiqi Chen via dev wrote: > Command with empty string following "dpctl/ct-get-limits zone=" > such as "ovs-appctl dpctl/ct-get-limits zone=" will cause > parse_ct_limit_zones() dereferencing null. > > Signed-off-by: Zhiqi Chen <chenzhiqi.123@bytedance.com> > --- Hi. Thanks for the fix! Could you, please, add a test for this issue to tests/dpctl.at ? Best regards, Ilya Maximets. > lib/dpctl.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/lib/dpctl.c b/lib/dpctl.c > index 3ba40fa8f..15950bd50 100644 > --- a/lib/dpctl.c > +++ b/lib/dpctl.c > @@ -2206,7 +2206,7 @@ parse_ct_limit_zones(const char *argv, struct ovs_list *zone_limits, > argcopy = xstrdup(argv + 5); > next_zone = strtok_r(argcopy, ",", &save_ptr); > > - do { > + while (next_zone != NULL) { > if (ovs_scan(next_zone, "%"SCNu16, &zone)) { > ct_dpif_push_zone_limit(zone_limits, zone, 0, 0); > } else { > @@ -2214,7 +2214,8 @@ parse_ct_limit_zones(const char *argv, struct ovs_list *zone_limits, > free(argcopy); > return EINVAL; > } > - } while ((next_zone = strtok_r(NULL, ",", &save_ptr)) != NULL); > + next_zone = strtok_r(NULL, ",", &save_ptr); > + } > > free(argcopy); > return 0;
diff --git a/lib/dpctl.c b/lib/dpctl.c index 3ba40fa8f..15950bd50 100644 --- a/lib/dpctl.c +++ b/lib/dpctl.c @@ -2206,7 +2206,7 @@ parse_ct_limit_zones(const char *argv, struct ovs_list *zone_limits, argcopy = xstrdup(argv + 5); next_zone = strtok_r(argcopy, ",", &save_ptr); - do { + while (next_zone != NULL) { if (ovs_scan(next_zone, "%"SCNu16, &zone)) { ct_dpif_push_zone_limit(zone_limits, zone, 0, 0); } else { @@ -2214,7 +2214,8 @@ parse_ct_limit_zones(const char *argv, struct ovs_list *zone_limits, free(argcopy); return EINVAL; } - } while ((next_zone = strtok_r(NULL, ",", &save_ptr)) != NULL); + next_zone = strtok_r(NULL, ",", &save_ptr); + } free(argcopy); return 0;
Command with empty string following "dpctl/ct-get-limits zone=" such as "ovs-appctl dpctl/ct-get-limits zone=" will cause parse_ct_limit_zones() dereferencing null. Signed-off-by: Zhiqi Chen <chenzhiqi.123@bytedance.com> --- lib/dpctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)