diff options
| author |   Dave Barach <dave@barachs.net> | 2016-07-23 19:25:37 -0400 |
|---|---|---|
| committer | Dave Barach <dave@barachs.net> | 2016-07-23 19:25:58 -0400 |
| commit | 9d716cdc3bab6f2772136afa276e2208278b14cf (patch) | |
| tree | 5a29762f9fd0c7f6b36712709497fd0d678db7a8 | |
| parent | 1642e3903d5467baf88531c96c733c285418b953 (diff) | |
VPP-108: fix buffer overrun
Probably not seen (yet) in practice due to the message ring allocation
scheme.
Change-Id: I7f01b5c09e0a172ad43ec3b8416e2791cada6122
Signed-off-by: Dave Barach <dave@barachs.net>
| -rw-r--r-- | vpp/vpp-api/api.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/vpp/vpp-api/api.c b/vpp/vpp-api/api.c index b47dc9e873c..feb1a61a5b0 100644 --- a/vpp/vpp-api/api.c +++ b/vpp/vpp-api/api.c @@ -6953,7 +6953,7 @@ static void vl_api_classify_table_ids_t_handler (vl_api_classify_table_ids_t *mp count = vec_len(table_ids); vl_api_classify_table_ids_reply_t *rmp; - rmp = vl_msg_api_alloc_as_if_client(sizeof (*rmp) + count); + rmp = vl_msg_api_alloc_as_if_client(sizeof (*rmp) + count * sizeof(u32)); rmp->_vl_msg_id = ntohs (VL_API_CLASSIFY_TABLE_IDS_REPLY); rmp->context = mp->context; rmp->count = ntohl(count); |