secchan: Correctly maintain rule's number of actions.

We were reallocating memory properly but not updating the "n_actions"
member, which sometimes led to reading past the end of a block.

This problem possibly caused segfaults, since the OpenFlow->ODP action
translation code assumes that OpenFlow actions are prevalidated, and
random memory is not necessarily valid OpenFlow actions :-)

Spotted by Valgrind.

diff --git a/secchan/ofproto.c b/secchan/ofproto.c
index 906a6a5e656cc44f7ecb132244ea4652ec4c85f2..d42a259fe5c494408a7b1ca4fb5b6d5b677ddce5 100644 (file)
--- a/secchan/ofproto.c
+++ b/secchan/ofproto.c
@@ -2215,6 +2215,7 @@ modify_flow(struct ofproto *p, const struct ofp_flow_mod *ofm,
             update_stats(rule, &odp_flow.stats);
         }
         rule = xrealloc(rule, rule_size(n_actions));
+        rule->n_actions = n_actions;
         memcpy(rule->actions, ofm->actions, n_actions * sizeof *rule->actions);
         cls_rule_moved(&p->cls, &old_rule->cr, &rule->cr);
     }