ofp-util: Avoid misaligned memory access in ofputil_encode_packet_in().

Reported-by: Murphy McCauley <murphy.mccauley@gmail.com>

diff --git a/AUTHORS b/AUTHORS
index 3229f3466077370f2feccd274437c53424e0fa09..4c743b5b96bb038c8df02d7d566b2401fc3e268f 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -84,6 +84,7 @@ Krishna Miriyala        krishna@nicira.com
 Luiz Henrique Ozaki     luiz.ozaki@gmail.com
 Michael Hu              mhu@nicira.com
 Michael Mao             mmao@nicira.com
+Murphy McCauley         murphy.mccauley@gmail.com
 Mikael Doverhag         mdoverhag@nicira.com
 Niklas Andersson        nandersson@nicira.com
 Pankaj Thakkar          thakkar@nicira.com

diff --git a/lib/ofp-util.c b/lib/ofp-util.c
index b46219a781eb3655b4069fdcbcc2fedc68cea9ed..09301962a86e0b035f12630de34902d77231af70 100644 (file)
--- a/lib/ofp-util.c
+++ b/lib/ofp-util.c
@@ -1449,7 +1449,7 @@ ofputil_encode_packet_in(const struct ofputil_packet_in *pin,
                         struct ofpbuf *rw_packet)
 {
     int total_len = pin->packet->size;
-    struct ofp_packet_in *opi;
+    struct ofp_packet_in opi;
 
     if (rw_packet) {
         if (pin->send_len < rw_packet->size) {
@@ -1462,13 +1462,14 @@ ofputil_encode_packet_in(const struct ofputil_packet_in *pin,
     }
 
     /* Add OFPT_PACKET_IN. */
-    opi = ofpbuf_push_zeros(rw_packet, offsetof(struct ofp_packet_in, data));
-    opi->header.version = OFP_VERSION;
-    opi->header.type = OFPT_PACKET_IN;
-    opi->total_len = htons(total_len);
-    opi->in_port = htons(pin->in_port);
-    opi->reason = pin->reason;
-    opi->buffer_id = htonl(pin->buffer_id);
+    memset(&opi, 0, sizeof opi);
+    opi.header.version = OFP_VERSION;
+    opi.header.type = OFPT_PACKET_IN;
+    opi.total_len = htons(total_len);
+    opi.in_port = htons(pin->in_port);
+    opi.reason = pin->reason;
+    opi.buffer_id = htonl(pin->buffer_id);
+    ofpbuf_push(rw_packet, &opi, offsetof(struct ofp_packet_in, data));
     update_openflow_length(rw_packet);
 
     return rw_packet;