summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndrew Yourtchenko <ayourtch@gmail.com>2021-02-06 12:28:52 +0000
committerDave Barach <openvpp@barachs.net>2021-02-07 12:35:45 +0000
commitf48de88527d324efebbc1af4f1a1d51ef030996d (patch)
tree264a967df8479316af34baab84f44e9a00d7928a
parenteec62306078de0eb3e38ae12b450bb2f6a075ec8 (diff)
vppinfra: do not crash if format string is null
Sending 128 bytes of zeroes via API shared memory interface (or putting any other message ID that results in null message name - e.g. 2,4,5) results in this crash: Program received signal SIGSEGV, Segmentation fault. va_format (s=0x7fffb5643a60 "memclnt_create", fmt=0x0, va=0x7fffa739ccf0) at /home/ubuntu/vpp/src/vppinfra/format.c:395 395 c = *f; (gdb) bt 0 va_format (s=0x7fffb5643a60 "memclnt_create", fmt=0x0, va=0x7fffa739ccf0) at /home/ubuntu/vpp/src/vppinfra/format.c:395 1 0x00007ffff50e7259 in elog_string (em=0x7ffff5f2fbc8 <vlib_global_main+968>, fmt=0x0) at /home/ubuntu/vpp/src/vppinfra/elog.c:592 2 0x00007ffff7bc4cec in vl_msg_api_handler_with_vm_node (am=0x7ffff7dd1c90 <api_global_main>, vlib_rp=0x130023000, the_msg=0x130086d50, vm=0x7ffff5f2f800 <vlib_global_main>, node=0x7fffb5edd4c0, is_private=0 '\000') at /home/ubuntu/vpp/src/vlibapi/api_shared.c:585 3 0x00007ffff7ba6c86 in void_mem_api_handle_msg_i (am=0x7ffff7dd1c90 <api_global_main>, vlib_rp=0x130023000, vm=<optimized out>, node=<optimized out>, is_private=0 '\000') at /home/ubuntu/vpp/src/vlibmemory/memory_api.c:696 4 vl_mem_api_handle_msg_main (vm=0x7ffff5f2f800 <vlib_global_main>, node=0x7fffb5edd4c0) at /home/ubuntu/vpp/src/vlibmemory/memory_api.c:707 5 0x00007ffff7bb573e in vl_api_clnt_process (vm=0x7ffff5f2f800 <vlib_global_main>, node=0x7fffb5edd4c0, f=<optimized out>) at /home/ubuntu/vpp/src/vlibmemory/vlib_api.c:338 6 0x00007ffff5cb3bb7 in vlib_process_bootstrap (_a=<optimized out>) at /home/ubuntu/vpp/src/vlib/main.c:1477 7 0x00007ffff514088c in clib_calljmp () from /home/ubuntu/vpp/build-root/install-vpp-native/vpp/lib/libvppinfra.so.21.01 8 0x00007fffa95b0550 in ?? () 9 0x00007ffff5ca93e2 in vlib_process_startup (vm=0x7ffff5f2f800 <vlib_global_main>, p=0x7fffb5edd4c0, f=0x0) at /home/ubuntu/vpp/src/vlib/main.c:1502 10 dispatch_process (vm=0x7ffff5f2f800 <vlib_global_main>, p=0x7fffb5edd4c0, f=0x0, last_time_stamp=<optimized out>) at /home/ubuntu/vpp/src/vlib/main.c:1558 11 0x0000000000000000 in ?? () (gdb) I am not sure if this place is better to fix it or the 4-5 places in vl_msg_api_handler_with_vm_node that it gets called from, but submitting this one since it is the shortest Type: fix Change-Id: I659d2bea7405d8763181336f35ef468682f64cf2 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
-rw-r--r--src/vlibapi/api_shared.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/src/vlibapi/api_shared.c b/src/vlibapi/api_shared.c
index 5e715d6f829..ec74b5fe357 100644
--- a/src/vlibapi/api_shared.c
+++ b/src/vlibapi/api_shared.c
@@ -454,7 +454,7 @@ msg_handler_internal (api_main_t * am,
u32 c;
} *ed;
ed = ELOG_DATA (am->elog_main, e);
- if (id < vec_len (am->msg_names))
+ if (id < vec_len (am->msg_names) && am->msg_names[id])
ed->c = elog_string (am->elog_main, (char *) am->msg_names[id]);
else
ed->c = elog_string (am->elog_main, "BOGUS");
@@ -537,7 +537,7 @@ msg_handler_internal (api_main_t * am,
u32 c;
} *ed;
ed = ELOG_DATA (am->elog_main, e);
- if (id < vec_len (am->msg_names))
+ if (id < vec_len (am->msg_names) && am->msg_names[id])
{
ed->c = elog_string (am->elog_main, (char *) am->msg_names[id]);
ed->barrier = !am->is_mp_safe[id];
@@ -579,7 +579,7 @@ vl_msg_api_handler_with_vm_node (api_main_t * am, svm_region_t * vlib_rp,
u32 c;
} *ed;
ed = ELOG_DATA (am->elog_main, e);
- if (id < vec_len (am->msg_names))
+ if (id < vec_len (am->msg_names) && am->msg_names[id])
ed->c = elog_string (am->elog_main, (char *) am->msg_names[id]);
else
ed->c = elog_string (am->elog_main, "BOGUS");
@@ -678,7 +678,7 @@ vl_msg_api_handler_with_vm_node (api_main_t * am, svm_region_t * vlib_rp,
u32 c;
} *ed;
ed = ELOG_DATA (am->elog_main, e);
- if (id < vec_len (am->msg_names))
+ if (id < vec_len (am->msg_names) && am->msg_names[id])
ed->c = elog_string (am->elog_main, (char *) am->msg_names[id]);
else
ed->c = elog_string (am->elog_main, "BOGUS");