[lng-odp] [PATCH] linux-generic: tm: out-of-bounds access to packet queue pools

[Oriol Arcas]

Signed-off-by: Oriol Arcas <or...@starflownetworks.com>
---
 platform/linux-generic/odp_pkt_queue.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/platform/linux-generic/odp_pkt_queue.c 
b/platform/linux-generic/odp_pkt_queue.c
index 7734ee9..be638a3 100644
--- a/platform/linux-generic/odp_pkt_queue.c
+++ b/platform/linux-generic/odp_pkt_queue.c
@@ -263,13 +263,13 @@ int _odp_pkt_queue_append(_odp_int_queue_pool_t 
queue_pool,
                return -3;
 
        pool->total_pkt_appends++;
-       first_blk_idx = pool->queue_num_tbl[queue_num];
+       first_blk_idx = pool->queue_num_tbl[queue_num - 1];
        if (first_blk_idx == 0) {
                first_blk = queue_blk_alloc(pool, &first_blk_idx);
                if (!first_blk)
                        return -1;
 
-               pool->queue_num_tbl[queue_num] = first_blk_idx;
+               pool->queue_num_tbl[queue_num - 1] = first_blk_idx;
                init_queue_blk(first_blk);
                first_blk->pkts[0] = pkt;
                return 0;
@@ -316,7 +316,7 @@ int _odp_pkt_queue_remove(_odp_int_queue_pool_t queue_pool,
        if ((queue_num == 0) || (pool->max_queue_num < queue_num))
                return -2;
 
-       first_blk_idx = pool->queue_num_tbl[queue_num];
+       first_blk_idx = pool->queue_num_tbl[queue_num - 1];
        if (first_blk_idx == 0)
                return 0; /* pkt queue is empty. */
 
@@ -344,7 +344,8 @@ int _odp_pkt_queue_remove(_odp_int_queue_pool_t queue_pool,
                                                first_blk->tail_queue_blk_idx;
                                }
 
-                               pool->queue_num_tbl[queue_num] = next_blk_idx;
+                               pool->queue_num_tbl[queue_num - 1] =
+                                               next_blk_idx;
                                queue_blk_free(pool, first_blk, first_blk_idx);
                        }
 
-- 
1.9.1