10865.diff

commit 33a3ee6b39acd9799301ec6cc0069bc9e4b4428b
Author: Yifeng Sun <pkusunyifeng@gmail.com>
Date:   Tue Nov 13 11:25:24 2018 -0800

    odp-util: Add checking to prevent buffer overflow when parsing push_nsh
    
    Previously, the buffer size of 'struct ofpbuf b' is less than the
    size of 'char buf[512]', this could cause memory overflow of ofpbuf
    when calling ofpbuf_put_hex. This patch fixes it.
    
    Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10865
    Signed-off-by: Yifeng Sun <pkusunyifeng@gmail.com>
    Signed-off-by: Ben Pfaff <blp@ovn.org>

diff --git a/lib/odp-util.c b/lib/odp-util.c
index 627baaa39..bb6669b37 100644
--- a/lib/odp-util.c
+++ b/lib/odp-util.c
@@ -2032,100 +2032,100 @@ static int
 parse_odp_push_nsh_action(const char *s, struct ofpbuf *actions)
 {
     int n = 0;
     int ret = 0;
     uint32_t spi = 0;
     uint8_t si = 255;
     uint32_t cd;
     struct ovs_key_nsh nsh;
     uint8_t metadata[NSH_CTX_HDRS_MAX_LEN];
     uint8_t md_size = 0;
 
     if (!ovs_scan_len(s, &n, "push_nsh(")) {
         ret = -EINVAL;
         goto out;
     }
 
     /* The default is NSH_M_TYPE1 */
     nsh.flags = 0;
     nsh.ttl = 63;
     nsh.mdtype = NSH_M_TYPE1;
     nsh.np = NSH_P_ETHERNET;
     nsh.path_hdr = nsh_spi_si_to_path_hdr(0, 255);
     memset(nsh.context, 0, NSH_M_TYPE1_MDLEN);
 
     for (;;) {
         n += strspn(s + n, delimiters);
         if (s[n] == ')') {
             break;
         }
 
         if (ovs_scan_len(s, &n, "flags=%"SCNi8, &nsh.flags)) {
             continue;
         }
         if (ovs_scan_len(s, &n, "ttl=%"SCNi8, &nsh.ttl)) {
             continue;
         }
         if (ovs_scan_len(s, &n, "mdtype=%"SCNi8, &nsh.mdtype)) {
             switch (nsh.mdtype) {
             case NSH_M_TYPE1:
                 /* This is the default format. */;
                 break;
             case NSH_M_TYPE2:
                 /* Length will be updated later. */
                 md_size = 0;
                 break;
             default:
                 ret = -EINVAL;
                 goto out;
             }
             continue;
         }
         if (ovs_scan_len(s, &n, "np=%"SCNi8, &nsh.np)) {
             continue;
         }
         if (ovs_scan_len(s, &n, "spi=0x%"SCNx32, &spi)) {
             continue;
         }
         if (ovs_scan_len(s, &n, "si=%"SCNi8, &si)) {
             continue;
         }
         if (nsh.mdtype == NSH_M_TYPE1) {
             if (ovs_scan_len(s, &n, "c1=0x%"SCNx32, &cd)) {
                 nsh.context[0] = htonl(cd);
                 continue;
             }
             if (ovs_scan_len(s, &n, "c2=0x%"SCNx32, &cd)) {
                 nsh.context[1] = htonl(cd);
                 continue;
             }
             if (ovs_scan_len(s, &n, "c3=0x%"SCNx32, &cd)) {
                 nsh.context[2] = htonl(cd);
                 continue;
             }
             if (ovs_scan_len(s, &n, "c4=0x%"SCNx32, &cd)) {
                 nsh.context[3] = htonl(cd);
                 continue;
             }
         }
         else if (nsh.mdtype == NSH_M_TYPE2) {
             struct ofpbuf b;
             char buf[512];
             size_t mdlen, padding;
-            if (ovs_scan_len(s, &n, "md2=0x%511[0-9a-fA-F]", buf)) {
-                ofpbuf_use_stub(&b, metadata,
-                                NSH_CTX_HDRS_MAX_LEN);
+            if (ovs_scan_len(s, &n, "md2=0x%511[0-9a-fA-F]", buf)
+                && n/2 <= sizeof metadata) {
+                ofpbuf_use_stub(&b, metadata, sizeof metadata);
                 ofpbuf_put_hex(&b, buf, &mdlen);
                 /* Pad metadata to 4 bytes. */
                 padding = PAD_SIZE(mdlen, 4);
                 if (padding > 0) {
                     ofpbuf_push_zeros(&b, padding);
                 }
                 md_size = mdlen + padding;
                 ofpbuf_uninit(&b);
                 continue;
             }
         }
 
         ret = -EINVAL;
         goto out;
     }