diff options
| author |   Benoît Ganne <bganne@cisco.com> | 2024-03-06 19:02:18 +0100 |
|---|---|---|
| committer |   Neale Ranns <neale@graphiant.com> | 2024-04-09 04:49:17 +0000 |
| commit | 7b899be710263dd334112f18db0f055625d9da5a (patch) | |
| tree | c8386ac880c40e4bad757537698d5c310d70f6c9 | |
| parent | 302db471a01b5c21b80e9bc769315cef4da0ed80 (diff) | |
fib: fix off-by-one error in rewrite length check
The rewrite string can be up to max_size, and max_size can be up to
VNET_REWRITE_TOTAL_BYTES. Don't waste the last byte.
Type: fix
Change-Id: I2fb7e9873b6b4c1e6a55b172c7f753f3c5910802
Signed-off-by: Benoît Ganne <bganne@cisco.com>
| -rw-r--r-- | src/vnet/adj/rewrite.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/vnet/adj/rewrite.h b/src/vnet/adj/rewrite.h index 5cb90e47318..06b1b00882e 100644 --- a/src/vnet/adj/rewrite.h +++ b/src/vnet/adj/rewrite.h @@ -147,8 +147,8 @@ vnet_rewrite_set_data_internal (vnet_rewrite_header_t * rw, int max_size, void *data, int data_bytes) { /* Sanity check values carefully for this clib_memset operation */ - ASSERT ((max_size > 0) && (max_size < VNET_REWRITE_TOTAL_BYTES)); - ASSERT ((data_bytes >= 0) && (data_bytes < max_size)); + ASSERT ((max_size > 0) && (max_size <= VNET_REWRITE_TOTAL_BYTES)); + ASSERT ((data_bytes >= 0) && (data_bytes <= max_size)); rw->data_bytes = data_bytes; clib_memcpy_fast (rw->data, data, data_bytes); |