From 66c0adf1ea73f1347ab5e3b929fa378a597aeb15 Mon Sep 17 00:00:00 2001 From: Matthew Smith Date: Wed, 9 Aug 2017 16:30:43 -0500 Subject: VPP-933 VPP crashes when deleting an ARP entry When attempting to delete an ARP entry on an interface that hasn't had any ARP entries added yet, VPP was retrieving an array element at an index that was out of bounds and trying to dereference it. Change-Id: Id141d3bfd8378dd8dd63f43b0b4b41461c285a4f Signed-off-by: Matthew Smith --- src/vnet/ethernet/arp.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/vnet/ethernet/arp.c') diff --git a/src/vnet/ethernet/arp.c b/src/vnet/ethernet/arp.c index c8d15784..c22be3fc 100644 --- a/src/vnet/ethernet/arp.c +++ b/src/vnet/ethernet/arp.c @@ -1635,6 +1635,9 @@ vnet_arp_unset_ip4_over_ethernet_internal (vnet_main_t * vnm, ethernet_arp_ip4_entry_t *e; ethernet_arp_interface_t *eai; + if (vec_len (am->ethernet_arp_by_sw_if_index) <= args->sw_if_index) + return 0; + eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index]; e = arp_entry_find (eai, &args->a.ip4); @@ -1659,6 +1662,9 @@ vnet_arp_flush_ip4_over_ethernet_internal (vnet_main_t * vnm, ethernet_arp_ip4_entry_t *e; ethernet_arp_interface_t *eai; + if (vec_len (am->ethernet_arp_by_sw_if_index) <= args->sw_if_index) + return 0; + eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index]; e = arp_entry_find (eai, &args->a.ip4); @@ -1692,6 +1698,7 @@ vnet_arp_populate_ip4_over_ethernet_internal (vnet_main_t * vnm, ethernet_arp_ip4_entry_t *e; ethernet_arp_interface_t *eai; + vec_validate (am->ethernet_arp_by_sw_if_index, args->sw_if_index); eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index]; e = arp_entry_find (eai, &args->a.ip4); -- cgit 1.2.3-korg