diff options
Diffstat (limited to 'usr.sbin/switchd')
| -rw-r--r-- | usr.sbin/switchd/ofp13.c | 20 |
1 files changed, 9 insertions, 11 deletions
diff --git a/usr.sbin/switchd/ofp13.c b/usr.sbin/switchd/ofp13.c index f02ad1f8840..721302451a7 100644 --- a/usr.sbin/switchd/ofp13.c +++ b/usr.sbin/switchd/ofp13.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ofp13.c,v 1.46 2019/11/21 06:22:57 akoshibe Exp $ */ +/* $OpenBSD: ofp13.c,v 1.47 2019/11/27 17:37:32 akoshibe Exp $ */ /* * Copyright (c) 2013-2016 Reyk Floeter <reyk@openbsd.org> @@ -780,7 +780,7 @@ ofp13_validate_action(struct switchd *sc, struct ofp_header *oh, print_map(type, ofp_action_map), len, ant->ant_ttl); break; case OFP_ACTION_SET_FIELD: - if (len < sizeof(*asf)) + if (len < sizeof(*asf) || len != OFP_ALIGN(len)) return (-1); if ((asf = ibuf_seek(ibuf, *off, sizeof(*asf))) == NULL) return (-1); @@ -791,16 +791,14 @@ ofp13_validate_action(struct switchd *sc, struct ofp_header *oh, print_map(type, ofp_action_map), len); len -= sizeof(*asf) - sizeof(asf->asf_field); - while (len > 0) { - if ((oxm = ibuf_seek(ibuf, moff, sizeof(*oxm))) - == NULL) - return (-1); - if (ofp13_validate_oxm(sc, oxm, oh, ibuf, moff) == -1) - return (-1); + if ((oxm = ibuf_seek(ibuf, moff, sizeof(*oxm))) == NULL) + return (-1); + if (ofp13_validate_oxm(sc, oxm, oh, ibuf, moff) == -1) + return (-1); - len -= sizeof(*oxm) + oxm->oxm_length; - moff += sizeof(*oxm) + oxm->oxm_length; - } + len -= sizeof(*oxm) + oxm->oxm_length; + if (len >= OFP_ALIGNMENT) + return (-1); break; default: |