The packet director argument is stored in a uint32_t but converted with
strtol() with no validation, so a malformed value is silently taken as
zero and a negative one wraps around. It is also converted through a
signed long, so on a 32-bit build a value above INT32_MAX saturates at
LONG_MAX rather than being stored.

It is documented as "Pkt_dir=0x00110F10" and read as base 16, so use
rte_kvargs_handle_hex32(), which keeps hexadecimal with or without the
0x prefix and validates the whole string. Both the documented form and a
bare "00110F10" are unchanged.

Signed-off-by: Stephen Hemminger <[email protected]>
---
 drivers/net/ark/ark_ethdev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ark/ark_ethdev.c b/drivers/net/ark/ark_ethdev.c
index 9272e271e6..8810b02849 100644
--- a/drivers/net/ark/ark_ethdev.c
+++ b/drivers/net/ark/ark_ethdev.c
@@ -896,7 +896,9 @@ process_pktdir_arg(const char *key, const char *value,
        struct ark_adapter *ark =
                (struct ark_adapter *)extra_args;
 
-       ark->pkt_dir_v = strtol(value, NULL, 16);
+       if (rte_kvargs_handle_hex32(key, value, &ark->pkt_dir_v) < 0)
+               return -EINVAL;
+
        ARK_PMD_LOG(DEBUG, "pkt_dir_v = 0x%x\n", ark->pkt_dir_v);
        return 0;
 }
-- 
2.53.0

Reply via email to