On 7/28/26 12:24 AM, Tristan Madani wrote: > From: Tristan Madani <[email protected]> > > ovsdb_jsonrpc_monitor_create() validates the params array length for > monitor_cond (V2, expects 3) and monitor_cond_since (V3, expects 4), > but not for monitor (V1). > > A monitor request with fewer than 3 elements causes json_array_at() > to return NULL for indices 1 and 2. The subsequent dereference of > monitor_requests->type crashes ovsdb-server. > > Add V1 to the existing bounds check so it requires exactly 3 params, > matching the V2 check. Before commit 9167cb52fa87 ("ovsdb-monitor: > Support monitor_cond_since."), the original guard checked all versions > uniformly; that commit narrowed the check to V2/V3 only. > > Fixes: 9167cb52fa87 ("ovsdb-monitor: Support monitor_cond_since.") > Signed-off-by: Tristan Madani <[email protected]> > --- > ovsdb/jsonrpc-server.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/ovsdb/jsonrpc-server.c b/ovsdb/jsonrpc-server.c > index 175f7bb4..92beb8ab 100644 > --- a/ovsdb/jsonrpc-server.c > +++ b/ovsdb/jsonrpc-server.c > @@ -1503,7 +1503,8 @@ ovsdb_jsonrpc_monitor_create(struct > ovsdb_jsonrpc_session *s, struct ovsdb *db, > struct shash_node *node; > struct json *json; > > - if ((version == OVSDB_MONITOR_V2 && json_array_size(params) != 3) || > + if (((version == OVSDB_MONITOR_V1 || version == OVSDB_MONITOR_V2) > + && json_array_size(params) != 3) || > (version == OVSDB_MONITOR_V3 && json_array_size(params) != 4)) {
This looks good to me, but please open the parenthesis, i.e. one line per monitor version, it's much easier to read if we have 3 similar lines. Best regards, Ilya Maximets. _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
