ofp-actions: Fix buffer overread in decode_LEARN_specs().
The length check was wrong for immediate arguments to "learn" actions.
Reported-at:
Acked-by: Justin Pettit
@@ -4741,7 +4741,7 @@ learn_min_len(uint16_t header)
min_len += sizeof(ovs_be32); /* src_field */
min_len += sizeof(ovs_be16); /* src_ofs */
} else {
- min_len += DIV_ROUND_UP(n_bits, 16);
+ min_len += 2 * DIV_ROUND_UP(n_bits, 16);
}
if (dst_type == NX_LEARN_DST_MATCH ||
dst_type == NX_LEARN_DST_LOAD) {
