summaryrefslogtreecommitdiffstats
path: root/src/vpp-api/client/stat_client.h
diff options
context:
space:
mode:
authorOle Troan <ot@cisco.com>2020-10-21 11:55:28 +0200
committerMatthew Smith <mgsmith@netgate.com>2020-10-21 18:58:58 +0000
commit65c56c83ce4e58178b5ad90a8f325692c9904381 (patch)
tree606128e07913c4221bb1e867cf39aa06b80238b1 /src/vpp-api/client/stat_client.h
parent7ff514b32c8b41366b408acf2c535298546c6d42 (diff)
stats: missing dimension in stat_set_simple_counter
A simple counter is a two dimensional array by threads and counter index. 28017 introduced an error missing the first dimension. If a vector is updated at the same time as a client reads, an invalid pointer my result. This will be caught by the optimistic locking after copying out the data, but if following a pointer outside of the stat segment then the stat client would crash. Add suitable boundary checks for access to stat memory segment. Fixes: 7d29e320fb2855a1ddb7a6af09078b8ed636de01 Type: fix Signed-off-by: Ole Troan <ot@cisco.com> Change-Id: I94f124ec71d98218c4eda5d124ac5594743d93d6
Diffstat (limited to 'src/vpp-api/client/stat_client.h')
-rw-r--r--src/vpp-api/client/stat_client.h8
1 files changed, 6 insertions, 2 deletions
diff --git a/src/vpp-api/client/stat_client.h b/src/vpp-api/client/stat_client.h
index c5fa5597758..f8473efd47f 100644
--- a/src/vpp-api/client/stat_client.h
+++ b/src/vpp-api/client/stat_client.h
@@ -101,8 +101,12 @@ _time_now_nsec (void)
static inline void *
stat_segment_adjust (stat_client_main_t * sm, void *data)
{
- return (void *) ((char *) sm->shared_header +
- ((char *) data - (char *) sm->shared_header->base));
+ void *p = (void *) ((char *) sm->shared_header +
+ ((char *) data - (char *) sm->shared_header->base));
+ if (p > (void *) sm->shared_header &&
+ ((p + sizeof (p)) < ((void *) sm->shared_header + sm->memory_size)))
+ return p;
+ return 0;
}
/*