diff options
| author |   Andrew Yourtchenko <ayourtch@gmail.com> | 2021-03-25 14:13:47 +0000 |
|---|---|---|
| committer |   Matthew Smith <mgsmith@netgate.com> | 2021-03-25 21:14:09 +0000 |
| commit | 22af286a2976339b25e11c23ac273e1781138fb7 (patch) | |
| tree | 683bd1e05aa36e874a49bfff8f1c869adddf1154 /src | |
| parent | abd8b36d19408403a40d24aa411686d52011a844 (diff) | |
acl: fix the integer overflow bug in API message length validation logic
Sending the bogus acl_add_replace message with count=~0 will result in
an overflow of "expected_len" field which is a u32, thus the message
will pass the validation when it should not.
Solution - make the expected_len a u64 to avoid overflow.
The bug was found while experimenting with libfuzzer as part of
https://gerrit.fd.io/r/c/vpp/+/31763
Type: fix
Change-Id: I4a866d48f2418148236f1b1d77c487b869c7c43d
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/plugins/acl/acl.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/plugins/acl/acl.c b/src/plugins/acl/acl.c index ba4243c6926..dcca2a2c9ba 100644 --- a/src/plugins/acl/acl.c +++ b/src/plugins/acl/acl.c @@ -1772,7 +1772,7 @@ macip_acl_interface_add_del_acl (u32 sw_if_index, u8 is_add, * */ static int -verify_message_len (void *mp, u32 expected_len, char *where) +verify_message_len (void *mp, u64 expected_len, char *where) { u32 supplied_len = vl_msg_api_get_msg_length (mp); if (supplied_len < expected_len) @@ -1796,7 +1796,7 @@ vl_api_acl_add_replace_t_handler (vl_api_acl_add_replace_t * mp) int rv; u32 acl_list_index = ntohl (mp->acl_index); u32 acl_count = ntohl (mp->count); - u32 expected_len = sizeof (*mp) + acl_count * sizeof (mp->r[0]); + u64 expected_len = sizeof (*mp) + acl_count * sizeof (mp->r[0]); if (verify_message_len (mp, expected_len, "acl_add_replace")) { @@ -2085,7 +2085,7 @@ vl_api_macip_acl_add_t_handler (vl_api_macip_acl_add_t * mp) int rv; u32 acl_list_index = ~0; u32 acl_count = ntohl (mp->count); - u32 expected_len = sizeof (*mp) + acl_count * sizeof (mp->r[0]); + u64 expected_len = sizeof (*mp) + acl_count * sizeof (mp->r[0]); if (verify_message_len (mp, expected_len, "macip_acl_add")) { @@ -2112,7 +2112,7 @@ vl_api_macip_acl_add_replace_t_handler (vl_api_macip_acl_add_replace_t * mp) int rv; u32 acl_list_index = ntohl (mp->acl_index); u32 acl_count = ntohl (mp->count); - u32 expected_len = sizeof (*mp) + acl_count * sizeof (mp->r[0]); + u64 expected_len = sizeof (*mp) + acl_count * sizeof (mp->r[0]); if (verify_message_len (mp, expected_len, "macip_acl_add_replace")) { |