In cmd_set_raw_parsed_sample(), the action list parsed by
"set sample_actions" is copied into raw_sample_confs[idx].data, a fixed
array of ACTION_SAMPLE_ACTIONS_NUM entries, without checking how many
actions were parsed. Supplying more actions than the array can hold
overflows the array. Supplying exactly as many actions as the array can
hold fills it completely and leaves no room for the terminating END
action, so the action list is read out of bounds later on.
Reject the command when the number of actions reaches
ACTION_SAMPLE_ACTIONS_NUM, so the last array entry stays reserved for
the terminating END action.
Fixes: 135e7de93258 ("app/testpmd: add command for sample action")
Cc: [email protected]
Signed-off-by: Linda Wang <[email protected]>
Reviewed-by: Joey Xing <[email protected]>
---
app/test-pmd/cmdline_flow.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/app/test-pmd/cmdline_flow.c b/app/test-pmd/cmdline_flow.c
index 68560673b4..a2e6f1f59a 100644
--- a/app/test-pmd/cmdline_flow.c
+++ b/app/test-pmd/cmdline_flow.c
@@ -13967,6 +13967,11 @@ cmd_set_raw_parsed_sample(const struct buffer *in)
action = in->args.vc.actions + i;
if (action->type == RTE_FLOW_ACTION_TYPE_END)
break;
+ /* Reserve the last slot for the terminating END action. */
+ if (i >= ACTION_SAMPLE_ACTIONS_NUM - 1) {
+ fprintf(stderr, "Error - too many sample actions\n");
+ return;
+ }
switch (action->type) {
case RTE_FLOW_ACTION_TYPE_MARK:
size = sizeof(struct rte_flow_action_mark);
--
2.55.0.windows.1
