In parse_odp_action__(), the value returned by parse_odp_push_nsh_action() is incremented by one before being returned. If it equals INT_MAX, the addition overflows, which is undefined behavior. Reject such input with -EINVAL before doing the addition.
Found by Coverity (INTEGER_OVERFLOW, return_value_error). Signed-off-by: Fei Wang <[email protected]> --- lib/odp-util.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/odp-util.c b/lib/odp-util.c index 43bb23cec..777a6cef2 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -2801,6 +2801,9 @@ parse_odp_action__(struct parse_odp_context *context, const char *s, if (retval < 0) { return retval; } + if (retval > INT_MAX - 1) { + return -EINVAL; + } return retval + 1; } } -- 2.55.0.windows.2 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
