aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins
diff options
context:
space:
mode:
authorDave Barach <dave@barachs.net>2020-04-08 12:03:32 -0400
committerFlorin Coras <florin.coras@gmail.com>2020-04-08 17:22:21 +0000
commit8324c55f95dd5ddbf1f5f9c47907204a12e152ef (patch)
tree0e83f7afa78b7f250be4384d775c01688a682486 /src/plugins
parent954c707972bf7efcd227e26d9679544813a78115 (diff)
ping: fix buffer allocator error handling
The code sets f->n_vectors = n_to_send, but it can bail out of the loop if vlib_buffer_copy(...) returns 0. Need to fix f->n_vectors in the error return path, or we enqueue some number of 0xfefefefe buffer indices in a debug image or worse in a production image. Type: fix Signed-off-by: Dave Barach <dave@barachs.net> Change-Id: I2d886266006c6c1c2f9ef8e3b95eb46ac6c0b3df
Diffstat (limited to 'src/plugins')
-rwxr-xr-xsrc/plugins/ping/ping.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/plugins/ping/ping.c b/src/plugins/ping/ping.c
index 7045648d872..f56f44ffb26 100755
--- a/src/plugins/ping/ping.c
+++ b/src/plugins/ping/ping.c
@@ -933,6 +933,8 @@ ip46_enqueue_packet (vlib_main_t * vm, vlib_buffer_t * b0, u32 burst,
* we did not enqueue it here yet.
*/
ship_and_ret:
+ ASSERT (n_to_send <= f->n_vectors);
+ f->n_vectors -= n_to_send;
n_sent += f->n_vectors;
vlib_put_frame_to_node (vm, lookup_node_index, f);
return n_sent;