parse_odp_push_nsh_action() stops scanning at the closing ')' but does not consume it, so parse_odp_action__() has to add one to its return value. Coverity flags this 'retval + 1' as a potential integer overflow.
Make parse_odp_push_nsh_action() consume the ')' itself, the same way parse_odp_psample_action() does, so that the caller can return its result directly. This removes the addition in the caller and makes the two parsers consistent. Found by Coverity (INTEGER_OVERFLOW, return_value_error). Signed-off-by: Fei Wang <[email protected]> --- lib/odp-util.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/lib/odp-util.c b/lib/odp-util.c index 43bb23cec..91669f058 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -2496,7 +2496,8 @@ out: size_t offset = nl_msg_start_nested(actions, OVS_ACTION_ATTR_PUSH_NSH); nsh_key_to_attr(actions, &nsh, metadata, md_size, false); nl_msg_end_nested(actions, offset); - ret = n; + /* Consume the closing ')'. */ + ret = n + 1; } return ret; } @@ -2795,14 +2796,8 @@ parse_odp_action__(struct parse_odp_context *context, const char *s, } } - { - if (!strncmp(s, "push_nsh(", 9)) { - int retval = parse_odp_push_nsh_action(s, actions); - if (retval < 0) { - return retval; - } - return retval + 1; - } + if (!strncmp(s, "push_nsh(", 9)) { + return parse_odp_push_nsh_action(s, actions); } { -- 2.55.0.windows.2 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
