This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "".

The branch, master has been updated via dd494a2b6a22f0516ce8890df05de826377fdae2 (commit) from 0bd1a1cea75d3788c062933e635849c35a0c6099 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit dd494a2b6a22f0516ce8890df05de826377fdae2 Author: Bill Fischofer bill.fischofer@linaro.org Date: Mon Jan 30 08:35:30 2017 -0600

helper: iplookuptable: avoid potential null pointer dereferences

Resolve Bug 2862 by checking pointer validity before dereferencing. https://bugs.linaro.org/show_bug.cgi?id=2862

Signed-off-by: Bill Fischofer bill.fischofer@linaro.org Reviewed-by: Mike Holmes mike.holmes@linaro.org Signed-off-by: Maxim Uvarov maxim.uvarov@linaro.org

diff --git a/helper/iplookuptable.c b/helper/iplookuptable.c index aaebea3..845125b 100644 --- a/helper/iplookuptable.c +++ b/helper/iplookuptable.c @@ -666,12 +666,14 @@ odph_iplookup_table_put_value(odph_table_t tbl, void *key, void *value) odph_iplookup_table_impl *impl = (void *)tbl; odph_iplookup_prefix_t *prefix = (odph_iplookup_prefix_t *)key; prefix_entry_t *l1e = NULL; - odp_buffer_t nexthop = *((odp_buffer_t *)value); + odp_buffer_t nexthop; int ret = 0;

if ((tbl == NULL) || (key == NULL) || (value == NULL)) return -1;

+ nexthop = *((odp_buffer_t *)value); + if (prefix->cidr == 0) return -1; prefix->ip = prefix->ip & (0xffffffff << (IP_LENGTH - prefix->cidr)); @@ -708,13 +710,16 @@ int odph_iplookup_table_get_value(odph_table_t tbl, void *key, uint32_t buffer_size ODP_UNUSED) { odph_iplookup_table_impl *impl = (void *)tbl; - uint32_t ip = *((uint32_t *)key); - prefix_entry_t *entry = &impl->l1e[ip >> 16]; + uint32_t ip; + prefix_entry_t *entry; odp_buffer_t *buff = (odp_buffer_t *)buffer;

if ((tbl == NULL) || (key == NULL) || (buffer == NULL)) return -EINVAL;

+ ip = *((uint32_t *)key); + entry = &impl->l1e[ip >> 16]; + if (entry == NULL) { ODPH_DBG("failed to get L1 entry.\n"); return -1; @@ -881,13 +886,16 @@ odph_iplookup_table_remove_value(odph_table_t tbl, void *key) { odph_iplookup_table_impl *impl = (void *)tbl; odph_iplookup_prefix_t *prefix = (odph_iplookup_prefix_t *)key; - uint32_t ip = prefix->ip; - uint8_t cidr = prefix->cidr; + uint32_t ip; + uint8_t cidr;

if ((tbl == NULL) || (key == NULL)) return -EINVAL;

- if (!prefix->cidr) + ip = prefix->ip; + cidr = prefix->cidr; + + if (cidr == 0) return -EINVAL;

prefix_entry_t *entry = &impl->l1e[ip >> 16];

-----------------------------------------------------------------------

Summary of changes: helper/iplookuptable.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)

hooks/post-receive