odp-util: Stop parse odp actions if nlattr is overflow

`encap = nl_msg_start_nested(key, OVS_KEY_ATTR_ENCAP)` ensures that key->size >= (encap + NLA_HDRLEN), so the `if` statement is safe. Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11306 Signed-off-by: Yifeng Sun <[email protected]> Signed-off-by: Ben Pfaff <[email protected]>
jsoref · Feb 4, 2019 · 401eacf · 401eacf
1 parent 1f886f0
commit 401eacf
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/lib/odp-util.c b/lib/odp-util.c
@@ -5599,6 +5599,10 @@ parse_odp_key_mask_attr(struct parse_odp_context *context, const char *s,
                 context->depth--;
                 return retval;
             }
+
+            if (nl_attr_oversized(key->size - encap - NLA_HDRLEN)) {
+                return -E2BIG;
+            }
             s += retval;
         }
         s++;