summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDave Barach <dave@barachs.net>2016-07-23 19:25:37 -0400
committerDave Barach <dave@barachs.net>2016-07-23 19:25:58 -0400
commit9d716cdc3bab6f2772136afa276e2208278b14cf (patch)
tree5a29762f9fd0c7f6b36712709497fd0d678db7a8
parent1642e3903d5467baf88531c96c733c285418b953 (diff)
VPP-108: fix buffer overrun
Probably not seen (yet) in practice due to the message ring allocation scheme. Change-Id: I7f01b5c09e0a172ad43ec3b8416e2791cada6122 Signed-off-by: Dave Barach <dave@barachs.net>
-rw-r--r--vpp/vpp-api/api.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/vpp/vpp-api/api.c b/vpp/vpp-api/api.c
index b47dc9e873c..feb1a61a5b0 100644
--- a/vpp/vpp-api/api.c
+++ b/vpp/vpp-api/api.c
@@ -6953,7 +6953,7 @@ static void vl_api_classify_table_ids_t_handler (vl_api_classify_table_ids_t *mp
count = vec_len(table_ids);
vl_api_classify_table_ids_reply_t *rmp;
- rmp = vl_msg_api_alloc_as_if_client(sizeof (*rmp) + count);
+ rmp = vl_msg_api_alloc_as_if_client(sizeof (*rmp) + count * sizeof(u32));
rmp->_vl_msg_id = ntohs (VL_API_CLASSIFY_TABLE_IDS_REPLY);
rmp->context = mp->context;
rmp->count = ntohl(count);