ofp-actions: Avoid buffer overread in BUNDLE action decoding.
Reported-at:
Acked-by: Justin Pettit
@@ -1380,13 +1380,14 @@ decode_bundle(bool load, const struct nx_action_bundle *nab,
load ? "bundle_load" : "bundle", slaves_size,
bundle->n_slaves * sizeof(ovs_be16), bundle->n_slaves);
error = OFPERR_OFPBAC_BAD_LEN;
- }
-
+ } else {
for (i = 0; i < bundle->n_slaves; i++) {
- ofp_port_t ofp_port = u16_to_ofp(ntohs(((ovs_be16 *)(nab + 1))[i]));
+ ofp_port_t ofp_port
+ = u16_to_ofp(ntohs(((ovs_be16 *)(nab + 1))[i]));
ofpbuf_put(ofpacts, &ofp_port, sizeof ofp_port);
bundle = ofpacts->header;
}
+ }
ofpact_finish_BUNDLE(ofpacts, &bundle);
if (!error) {
