On 10/7/26 8:56 PM, [email protected] wrote: > From: Tristan Madani <[email protected]> > > ovsdb_jsonrpc_monitor_create() validates the params array length for > monitor_cond (V2, expects 3) and monitor_cond_since (V3, expects 4), > but not for monitor (V1). > > A monitor request with fewer than 3 elements causes json_array_at() > to return NULL for indices 1 and 2. The subsequent dereference of > monitor_requests->type crashes ovsdb-server. > > Add V1 to the existing bounds check so it requires exactly 3 params, > matching the V2 check. Before commit 9167cb52fa87 ("ovsdb-monitor: > Support monitor_cond_since."), the original guard checked all versions > uniformly; that commit narrowed the check to V2/V3 only. > > Fixes: 9167cb52fa87 ("ovsdb-monitor: Support monitor_cond_since.") > Signed-off-by: Tristan Madani <[email protected]> > --- > ovsdb/jsonrpc-server.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/ovsdb/jsonrpc-server.c b/ovsdb/jsonrpc-server.c > index 175f7bb..92e8222 100644 > --- a/ovsdb/jsonrpc-server.c > +++ b/ovsdb/jsonrpc-server.c > @@ -1503,7 +1503,8 @@ ovsdb_jsonrpc_monitor_create(struct > ovsdb_jsonrpc_session *s, struct ovsdb *db, > struct shash_node *node; > struct json *json; > > - if ((version == OVSDB_MONITOR_V2 && json_array_size(params) != 3) || > + if ((version == OVSDB_MONITOR_V1 && json_array_size(params) != 3) || > + (version == OVSDB_MONITOR_V2 && json_array_size(params) != 3) || > (version == OVSDB_MONITOR_V3 && json_array_size(params) != 4)) { > error = ovsdb_syntax_error(params, NULL, "invalid parameters"); > goto error;
Thanks! Applied and backported this one down to 3.3. Best regards, Ilya Maximets. _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
