From: Shagun Agrawal Date: Mon, 27 Aug 2018 12:53:31 +0000 (+0530) Subject: net/cxgbe: fix memory access when parsing flow match items X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=450f99ce7b34cb27f6727cea478292428b328a70;p=dpdk.git net/cxgbe: fix memory access when parsing flow match items Coverity issue: 293096 Fixes: ee61f5113b17 ("net/cxgbe: parse and validate flows") Cc: stable@dpdk.org Signed-off-by: Shagun Agrawal Signed-off-by: Rahul Lakkireddy --- diff --git a/drivers/net/cxgbe/cxgbe_flow.c b/drivers/net/cxgbe/cxgbe_flow.c index 01c945f1b1..038d479d6b 100644 --- a/drivers/net/cxgbe/cxgbe_flow.c +++ b/drivers/net/cxgbe/cxgbe_flow.c @@ -454,10 +454,10 @@ cxgbe_rtef_parse_items(struct rte_flow *flow, char repeat[ARRAY_SIZE(parseitem)] = {0}; for (i = items; i->type != RTE_FLOW_ITEM_TYPE_END; i++) { - struct chrte_fparse *idx = &flow->item_parser[i->type]; + struct chrte_fparse *idx; int ret; - if (i->type > ARRAY_SIZE(parseitem)) + if (i->type >= ARRAY_SIZE(parseitem)) return rte_flow_error_set(e, ENOTSUP, RTE_FLOW_ERROR_TYPE_ITEM, i, "Item not supported"); @@ -478,6 +478,7 @@ cxgbe_rtef_parse_items(struct rte_flow *flow, if (ret) return ret; + idx = &flow->item_parser[i->type]; if (!idx || !idx->fptr) { return rte_flow_error_set(e, ENOTSUP, RTE_FLOW_ERROR_TYPE_ITEM, i,