secchan: Fix use-after-free by allocating rule actions as separate blocks.
authorBen Pfaff <blp@nicira.com>
Fri, 6 Mar 2009 17:52:08 +0000 (09:52 -0800)
committerBen Pfaff <blp@nicira.com>
Fri, 6 Mar 2009 17:53:47 +0000 (09:53 -0800)
commitd3bdf5a715fd7e8684738737ab5602593e1819be
tree48eba22e51ebcee4850858cf8989c77e405a71d8
parent4526edad1dc7c0eec25b8c10790f3207f89837f8
secchan: Fix use-after-free by allocating rule actions as separate blocks.

The ofproto code tried to cleverly save memory and time by allocating
rule actions as a flexible array member at the end of "struct rule".  When
the actions changed, this required a realloc() call.  Unfortunately, there
are sometimes pointers to rules (e.g. the "super" pointer from subrules)
that were not getting adjusted to point to the new location.

It's better to just allocate actions separately, so fix it by doing that.
secchan/ofproto.c