Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12557
Signed-off-by: Yifeng Sun <[email protected]>
---
include/openvswitch/ofp-actions.h | 4 ++++
lib/ofp-actions.c | 5 +++++
2 files changed, 9 insertions(+)
diff --git a/include/openvswitch/ofp-actions.h
b/include/openvswitch/ofp-actions.h
index caaa37c05a1d..14c5eab74bd3 100644
--- a/include/openvswitch/ofp-actions.h
+++ b/include/openvswitch/ofp-actions.h
@@ -1175,7 +1175,11 @@ struct ofpact_parse_params {
/* Output. */
struct ofpbuf *ofpacts;
enum ofputil_protocol *usable_protocols;
+
+ /* Parse context. */
+ unsigned int depth;
};
+#define MAX_OFPACT_PARSE_DEPTH 100
char *ofpacts_parse_actions(const char *, const struct ofpact_parse_params *)
OVS_WARN_UNUSED_RESULT;
char *ofpacts_parse_instructions(const char *,
diff --git a/lib/ofp-actions.c b/lib/ofp-actions.c
index f76db6c0f948..6f175186498d 100644
--- a/lib/ofp-actions.c
+++ b/lib/ofp-actions.c
@@ -9062,11 +9062,16 @@ static char * OVS_WARN_UNUSED_RESULT
ofpacts_parse(char *str, const struct ofpact_parse_params *pp,
bool allow_instructions, enum ofpact_type outer_action)
{
+ if (pp->depth >= MAX_OFPACT_PARSE_DEPTH) {
+ return xstrdup("Action nested too deeply");
+ }
+ CONST_CAST(struct ofpact_parse_params *, pp)->depth++;
uint32_t orig_size = pp->ofpacts->size;
char *error = ofpacts_parse__(str, pp, allow_instructions, outer_action);
if (error) {
pp->ofpacts->size = orig_size;
}
+ CONST_CAST(struct ofpact_parse_params *, pp)->depth--;
return error;
}
--
2.7.4
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
