ofp-util: Fix buffer overread in ofputil_pull_queue_get_config_reply10().
msg->size isn't the relevant measurement here because we're only supposed
to read 'len' bytes.  Reading more than that causes 'len' to underflow to a
large number at the end of the loop.
Reported-by: Bhargava Shastry
Acked-by: Greg Rose
@@ -2610,7 +2610,7 @@ ofputil_pull_queue_get_config_reply10(struct ofpbuf *msg,
hdr = ofpbuf_at_assert(msg, 0, sizeof *hdr);
prop_len = ntohs(hdr->len);
- if (prop_len < sizeof *hdr || prop_len > msg->size || prop_len % 8) {
+ if (prop_len < sizeof *hdr || prop_len > len || prop_len % 8) {
return OFPERR_OFPBRC_BAD_LEN;
}
