On 30 Sep 2026, at 13:24, Fei Wang via dev wrote:
> In parse_odp_action__(), the value returned by
> parse_odp_push_nsh_action() is incremented by one before being
> returned. If it equals INT_MAX, the addition overflows, which is
> undefined behavior. Reject such input with -EINVAL before doing the
> addition.
>
> Found by Coverity (INTEGER_OVERFLOW, return_value_error).
Thanks for the patch Fei,
However, rather than patching around this, the right fix is to make
parse_odp_push_nsh_action() behave like parse_odp_psample_action():
it already scans push_nsh( internally but leaves the closing )
for the caller, unlike psample which does n++ before returning
to consume it itself. If push_nsh followed the same pattern, the
+1 and this overflow guard would be unnecessary.
//Eelco
> Signed-off-by: Fei Wang <[email protected]>
> ---
> lib/odp-util.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/lib/odp-util.c b/lib/odp-util.c
> index 43bb23cec..777a6cef2 100644
> --- a/lib/odp-util.c
> +++ b/lib/odp-util.c
> @@ -2801,6 +2801,9 @@ parse_odp_action__(struct parse_odp_context *context,
> const char *s,
> if (retval < 0) {
> return retval;
> }
> + if (retval > INT_MAX - 1) {
> + return -EINVAL;
> + }
> return retval + 1;
> }
> }
> --
> 2.55.0.windows.2
>
> _______________________________________________
> dev mailing list
> [email protected]
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
