From patchwork Thu Sep 21 16:59:58 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Pfaff X-Patchwork-Id: 817065 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3xyjhg5Zxxz9t4c for ; Fri, 22 Sep 2017 03:07:15 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id D08BFBEA; Thu, 21 Sep 2017 17:05:20 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 1B317B7A for ; Thu, 21 Sep 2017 17:05:20 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from relay6-d.mail.gandi.net (relay6-d.mail.gandi.net [217.70.183.198]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id C3ED2204 for ; Thu, 21 Sep 2017 17:05:19 +0000 (UTC) X-Originating-IP: 173.228.112.34 Received: from sigabrt.gateway.sonic.net (173-228-112-34.dsl.dynamic.fusionbroadband.com [173.228.112.34]) (Authenticated sender: blp@ovn.org) by relay6-d.mail.gandi.net (Postfix) with ESMTPSA id 9A47BFB8AC; Thu, 21 Sep 2017 19:05:16 +0200 (CEST) From: Ben Pfaff To: dev@openvswitch.org Date: Thu, 21 Sep 2017 09:59:58 -0700 Message-Id: <20170921165958.3218-4-blp@ovn.org> X-Mailer: git-send-email 2.10.2 In-Reply-To: <20170921165958.3218-1-blp@ovn.org> References: <20170921165958.3218-1-blp@ovn.org> X-Spam-Status: No, score=-0.7 required=5.0 tests=RCVD_IN_DNSWL_LOW autolearn=disabled version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Cc: Ben Pfaff , Bhargava Shastry Subject: [ovs-dev] [PATCH v4 3/3] ofp-util: Fix memory leaks when parsing OF1.5 group properties. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Found by libFuzzer. Reported-by: Bhargava Shastry Signed-off-by: Ben Pfaff Acked-by: Justin Pettit --- lib/ofp-util.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/lib/ofp-util.c b/lib/ofp-util.c index 2309a2ad2515..16c4f191a340 100644 --- a/lib/ofp-util.c +++ b/lib/ofp-util.c @@ -9581,8 +9581,13 @@ ofputil_decode_ofp15_group_desc_reply(struct ofputil_group_desc *gd, * Such properties are valid for group desc replies so * claim that the group mod command is OFPGC15_ADD to * satisfy the check in parse_group_prop_ntr_selection_method() */ - return parse_ofp15_group_properties(msg, gd->type, OFPGC15_ADD, &gd->props, - length - sizeof *ogds - bucket_list_len); + error = parse_ofp15_group_properties( + msg, gd->type, OFPGC15_ADD, &gd->props, + length - sizeof *ogds - bucket_list_len); + if (error) { + ofputil_bucket_list_destroy(&gd->buckets); + } + return error; } /* Converts a group description reply in 'msg' into an abstract @@ -9881,8 +9886,12 @@ ofputil_pull_ofp15_group_mod(struct ofpbuf *msg, enum ofp_version ofp_version, return error; } - return parse_ofp15_group_properties(msg, gm->type, gm->command, &gm->props, - msg->size); + error = parse_ofp15_group_properties(msg, gm->type, gm->command, + &gm->props, msg->size); + if (error) { + ofputil_bucket_list_destroy(&gm->buckets); + } + return error; } static enum ofperr