diff options
| author |   reyk <reyk@openbsd.org> | 2017-08-11 13:50:15 +0000 |
|---|---|---|
| committer | reyk <reyk@openbsd.org> | 2017-08-11 13:50:15 +0000 |
| commit | f0093bece68294f943035d1293a57e7d9eac3938 (patch) | |
| tree | 3236462401d6be50f3693df1ccfc00caed54627c /sys/net/switchofp.c | |
| parent | Fix out-of-bounds read when looking up the message handler. (diff) | |
| download | wireguard-openbsd-f0093bece68294f943035d1293a57e7d9eac3938.tar.xz wireguard-openbsd-f0093bece68294f943035d1293a57e7d9eac3938.zip | |
Fix out-of-bounds read when looking up the multipart message handler.
This could be triggered by an OpenFlow packet with the multipart
message type of 14 ... because C array indexes start at 0.
Coverity CID 1452917; Severity: Major
OK millert@ goda@
Diffstat (limited to 'sys/net/switchofp.c')
| -rw-r--r-- | sys/net/switchofp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net/switchofp.c b/sys/net/switchofp.c index 1a56b73ed64..e38c9d2e70e 100644 --- a/sys/net/switchofp.c +++ b/sys/net/switchofp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: switchofp.c,v 1.63 2017/08/11 13:48:21 reyk Exp $ */ +/* $OpenBSD: switchofp.c,v 1.64 2017/08/11 13:50:15 reyk Exp $ */ /* * Copyright (c) 2016 Kazuya GODA <goda@openbsd.org> @@ -1224,7 +1224,7 @@ swofp_lookup_msg_handler(uint8_t type) ofp_msg_handler swofp_lookup_mpmsg_handler(uint16_t type) { - if (type > nitems(ofp_mpmsg_table)) + if (type >= nitems(ofp_mpmsg_table)) return (NULL); else return (ofp_mpmsg_table[type].mpmsg_handler); |