From patchwork Fri Aug 10 19:30:40 2018
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Ben Pfaff <blp@ovn.org>
X-Patchwork-Id: 956452
Return-Path: <ovs-dev-bounces@openvswitch.org>
X-Original-To: incoming@patchwork.ozlabs.org
Delivered-To: patchwork-incoming@bilbo.ozlabs.org
Authentication-Results: ozlabs.org;
	spf=pass (mailfrom) smtp.mailfrom=openvswitch.org
	(client-ip=140.211.169.12; helo=mail.linuxfoundation.org;
	envelope-from=ovs-dev-bounces@openvswitch.org;
	receiver=<UNKNOWN>)
Authentication-Results: ozlabs.org;
	dmarc=none (p=none dis=none) header.from=ovn.org
Received: from mail.linuxfoundation.org (mail.linuxfoundation.org
	[140.211.169.12])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
	bits)) (No client certificate requested)
	by ozlabs.org (Postfix) with ESMTPS id 41nFbJ4bDTz9s47
	for <incoming@patchwork.ozlabs.org>;
	Sat, 11 Aug 2018 05:30:51 +1000 (AEST)
Received: from mail.linux-foundation.org (localhost [127.0.0.1])
	by mail.linuxfoundation.org (Postfix) with ESMTP id A7DE9DDF;
	Fri, 10 Aug 2018 19:30:48 +0000 (UTC)
X-Original-To: dev@openvswitch.org
Delivered-To: ovs-dev@mail.linuxfoundation.org
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id C2565D3E
	for <dev@openvswitch.org>; Fri, 10 Aug 2018 19:30:47 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from relay1-d.mail.gandi.net (relay1-d.mail.gandi.net
	[217.70.183.193])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 3475CA7
	for <dev@openvswitch.org>; Fri, 10 Aug 2018 19:30:46 +0000 (UTC)
X-Originating-IP: 208.91.3.26
Received: from sigabrt.benpfaff.org (unknown [208.91.3.26])
	(Authenticated sender: blp@ovn.org)
	by relay1-d.mail.gandi.net (Postfix) with ESMTPSA id 01299240003;
	Fri, 10 Aug 2018 19:30:43 +0000 (UTC)
From: Ben Pfaff <blp@ovn.org>
To: dev@openvswitch.org
Date: Fri, 10 Aug 2018 12:30:40 -0700
Message-Id: <20180810193040.18352-1-blp@ovn.org>
X-Mailer: git-send-email 2.16.1
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_LOW
	autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
Cc: Ben Pfaff <blp@ovn.org>
Subject: [ovs-dev] [PATCH] ofp-port: Fix null dereference parsing Intel
	custom statistics.
X-BeenThere: ovs-dev@openvswitch.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: <ovs-dev.openvswitch.org>
List-Unsubscribe: <https://mail.openvswitch.org/mailman/options/ovs-dev>,
	<mailto:ovs-dev-request@openvswitch.org?subject=unsubscribe>
List-Archive: <http://mail.openvswitch.org/pipermail/ovs-dev/>
List-Post: <mailto:ovs-dev@openvswitch.org>
List-Help: <mailto:ovs-dev-request@openvswitch.org?subject=help>
List-Subscribe: <https://mail.openvswitch.org/mailman/listinfo/ovs-dev>,
	<mailto:ovs-dev-request@openvswitch.org?subject=subscribe>
MIME-Version: 1.0
Sender: ovs-dev-bounces@openvswitch.org
Errors-To: ovs-dev-bounces@openvswitch.org

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9788
Fixes: 7333c3b1ce02 ("ofp-port: Fix buffer overread parsing Intel custom statistics.")
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Justin Pettit <jpettit@ovn.org.
---
 lib/ofp-port.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ofp-port.c b/lib/ofp-port.c
index 2c812f8ecfa3..8d882a14b4df 100644
--- a/lib/ofp-port.c
+++ b/lib/ofp-port.c
@@ -1616,7 +1616,7 @@ parse_intel_port_custom_property(struct ofpbuf *payload,
 
         /* Counter name. */
         uint8_t *name_len = ofpbuf_try_pull(payload, sizeof *name_len);
-        char *name = ofpbuf_try_pull(payload, *name_len);
+        char *name = name_len ? ofpbuf_try_pull(payload, *name_len) : NULL;
         if (!name_len || !name) {
             return OFPERR_OFPBPC_BAD_LEN;
         }