flow: Fix buffer overread in flow_hash_symmetric_l3l4().

IPv6 addresses have 2 64-bit parts, but this code thought they have 4. Found by Coverity. Reported-at: https://scan3.coverity.com/reports.htm#v16889/p10449/fileInstanceId=14762918&defectInstanceId=4304099&mergedDefectId=179866 Signed-off-by: Ben Pfaff <[email protected]> Acked-by: Justin Pettit <[email protected]>
wanlebing · Jun 2, 2017 · caaabd1 · caaabd1
1 parent 3b048d7
commit caaabd1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/flow.c b/lib/flow.c
@@ -1931,7 +1931,7 @@ flow_hash_symmetric_l3l4(const struct flow *flow, uint32_t basis,
         const uint64_t *a = ALIGNED_CAST(uint64_t *, flow->ipv6_src.s6_addr);
         const uint64_t *b = ALIGNED_CAST(uint64_t *, flow->ipv6_dst.s6_addr);
 
-        for (int i = 0; i < 4; i++) {
+        for (int i = 0; i < sizeof flow->ipv6_src / sizeof *a; i++) {
             hash = hash_add64(hash, a[i] ^ b[i]);
         }
     } else {