odp-util: Fix a use-after-free bug.
After ofpbuf_put, actions may have been reallocated and
key will point to invalid memory address.
Reported-at:
Reported-at:
@@ -2242,13 +2242,14 @@ parse_odp_action(const char *s, const struct simap *port_names,
key->nla_len += size;
ofpbuf_put(actions, mask + 1, size);
- /* Add new padding as needed */
- ofpbuf_put_zeros(actions, NLA_ALIGN(key->nla_len) -
- key->nla_len);
-
/* 'actions' may have been reallocated by ofpbuf_put(). */
nested = ofpbuf_at_assert(actions, start_ofs, sizeof *nested);
nested->nla_type = OVS_ACTION_ATTR_SET_MASKED;
+
+ key = nested + 1;
+ /* Add new padding as needed */
+ ofpbuf_put_zeros(actions, NLA_ALIGN(key->nla_len) -
+ key->nla_len);
}
}
ofpbuf_uninit(&maskbuf);
