https://bugs.dpdk.org/show_bug.cgi?id=2104
Bug ID: 2104
Summary: pipeline: table entry parser accepts actions not
belonging to the table
Product: DPDK
Version: 26.11
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: major
Priority: Normal
Component: other
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Found by build with GCC 16 and -fanalyzer flag.
rte_swx_ctl_pipeline_table_entry_read() (lib/pipeline/rte_swx_ctl.c:3131) finds
the action with action_find(ctl, tokens[1]), which searches all pipeline
actions. It does not check that the action is one of the table's actions.
entry->action_data is allocated from table->params.action_data_size (:321), or
left NULL when that is 0. table_entry_action_argument_read() (:2896) then
copies the arguments into it. An entry line naming an action with more argument
bytes than the table allows writes past the buffer, or to NULL.
--
You are receiving this mail because:
You are the assignee for the bug.
