flow: Avoid assertion failure on invalid IPv6 packet.
authorJesse Gross <jesse@nicira.com>
Wed, 2 Mar 2011 01:56:01 +0000 (17:56 -0800)
committerJesse Gross <jesse@nicira.com>
Wed, 2 Mar 2011 23:53:11 +0000 (15:53 -0800)
We compute the length of the IPv6 header by parsing all of the
extension headers that we know about.  However, the final result
is checked using ofpbuf_pull(), which checks the size with an
assertion.  Since the length of the final header is not checked
in any other way an invalid packet can trigger this assertion.

lib/flow.c

index 879e462f0d059b487182d57456e6c67f39a45a36..6928f74eca1c29c718ba198366a4be45f26375a4 100644 (file)
@@ -414,7 +414,7 @@ flow_extract(struct ofpbuf *packet, ovs_be64 tun_id, uint16_t in_port,
             return 0;
         }
 
-        nh = ofpbuf_pull(&b, nh_len);
+        nh = ofpbuf_try_pull(&b, nh_len);
         if (nh) {
             packet->l4 = b.data;
             if (flow->nw_proto == IPPROTO_TCP) {