From 450f99ce7b34cb27f6727cea478292428b328a70 Mon Sep 17 00:00:00 2001 From: Shagun Agrawal Date: Mon, 27 Aug 2018 18:23:31 +0530 Subject: [PATCH] net/cxgbe: fix memory access when parsing flow match items Coverity issue: 293096 Fixes: ee61f5113b17 ("net/cxgbe: parse and validate flows") Cc: stable@dpdk.org Signed-off-by: Shagun Agrawal Signed-off-by: Rahul Lakkireddy --- drivers/net/cxgbe/cxgbe_flow.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/cxgbe/cxgbe_flow.c b/drivers/net/cxgbe/cxgbe_flow.c index 01c945f1b1..038d479d6b 100644 --- a/drivers/net/cxgbe/cxgbe_flow.c +++ b/drivers/net/cxgbe/cxgbe_flow.c @@ -454,10 +454,10 @@ cxgbe_rtef_parse_items(struct rte_flow *flow, char repeat[ARRAY_SIZE(parseitem)] = {0}; for (i = items; i->type != RTE_FLOW_ITEM_TYPE_END; i++) { - struct chrte_fparse *idx = &flow->item_parser[i->type]; + struct chrte_fparse *idx; int ret; - if (i->type > ARRAY_SIZE(parseitem)) + if (i->type >= ARRAY_SIZE(parseitem)) return rte_flow_error_set(e, ENOTSUP, RTE_FLOW_ERROR_TYPE_ITEM, i, "Item not supported"); @@ -478,6 +478,7 @@ cxgbe_rtef_parse_items(struct rte_flow *flow, if (ret) return ret; + idx = &flow->item_parser[i->type]; if (!idx || !idx->fptr) { return rte_flow_error_set(e, ENOTSUP, RTE_FLOW_ERROR_TYPE_ITEM, i, -- 2.20.1