diff mbox series

[ovs-dev,v1] odp-util: Avoid integer overflow when parsing push_nsh action.

Message ID 20260930112417.1652-1-fei.wang@jaguarmicro.com
State New
Headers show
Series [ovs-dev,v1] odp-util: Avoid integer overflow when parsing push_nsh action. | expand

Checks

Context Check Description
ovsrobot/apply-robot success apply and check: success
ovsrobot/github-robot-_Build_and_Test success github build: passed
ovsrobot/github-robot-_FreeBSD_Build_and_Test success github build: passed

Commit Message

Fei Wang Sept. 30, 2026, 11:24 a.m. UTC 
In parse_odp_action__(), the value returned by
parse_odp_push_nsh_action() is incremented by one before being
returned.  If it equals INT_MAX, the addition overflows, which is
undefined behavior.  Reject such input with -EINVAL before doing the
addition.

Found by Coverity (INTEGER_OVERFLOW, return_value_error).

Signed-off-by: Fei Wang <fei.wang@jaguarmicro.com>
---
 lib/odp-util.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/lib/odp-util.c b/lib/odp-util.c
index 43bb23cec..777a6cef2 100644
--- a/lib/odp-util.c
+++ b/lib/odp-util.c
@@ -2801,6 +2801,9 @@  parse_odp_action__(struct parse_odp_context *context, const char *s,
             if (retval < 0) {
                 return retval;
             }
+            if (retval > INT_MAX - 1) {
+                return -EINVAL;
+            }
             return retval + 1;
         }
     }