diff options
| author |   Ole Troan <ot@cisco.com> | 2020-10-21 11:55:28 +0200 |
|---|---|---|
| committer |   Matthew Smith <mgsmith@netgate.com> | 2020-10-21 18:58:58 +0000 |
| commit | 65c56c83ce4e58178b5ad90a8f325692c9904381 (patch) | |
| tree | 606128e07913c4221bb1e867cf39aa06b80238b1 /src/vpp-api/client/stat_client.h | |
| parent | 7ff514b32c8b41366b408acf2c535298546c6d42 (diff) | |
stats: missing dimension in stat_set_simple_counter
A simple counter is a two dimensional array by threads and
counter index. 28017 introduced an error missing the first
dimension.
If a vector is updated at the same time as a client reads,
an invalid pointer my result. This will be caught by the
optimistic locking after copying out the data, but if
following a pointer outside of the stat segment then
the stat client would crash. Add suitable boundary checks
for access to stat memory segment.
Fixes: 7d29e320fb2855a1ddb7a6af09078b8ed636de01
Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I94f124ec71d98218c4eda5d124ac5594743d93d6
Diffstat (limited to 'src/vpp-api/client/stat_client.h')
| -rw-r--r-- | src/vpp-api/client/stat_client.h | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/vpp-api/client/stat_client.h b/src/vpp-api/client/stat_client.h index c5fa5597758..f8473efd47f 100644 --- a/src/vpp-api/client/stat_client.h +++ b/src/vpp-api/client/stat_client.h @@ -101,8 +101,12 @@ _time_now_nsec (void) static inline void * stat_segment_adjust (stat_client_main_t * sm, void *data) { - return (void *) ((char *) sm->shared_header + - ((char *) data - (char *) sm->shared_header->base)); + void *p = (void *) ((char *) sm->shared_header + + ((char *) data - (char *) sm->shared_header->base)); + if (p > (void *) sm->shared_header && + ((p + sizeof (p)) < ((void *) sm->shared_header + sm->memory_size))) + return p; + return 0; } /* |