Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/92053/?format=api
{ "id": 92053, "url": "http://patches.dpdk.org/api/patches/92053/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/1619163488-63913-1-git-send-email-humin29@huawei.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<1619163488-63913-1-git-send-email-humin29@huawei.com>", "list_archive_url": "https://inbox.dpdk.org/dev/1619163488-63913-1-git-send-email-humin29@huawei.com", "date": "2021-04-23T07:38:08", "name": "app/testeventdev: fix buffer overflow", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "18dcfc62a930ae4db35bd282c19ff82e17778f12", "submitter": { "id": 1944, "url": "http://patches.dpdk.org/api/people/1944/?format=api", "name": "humin (Q)", "email": "humin29@huawei.com" }, "delegate": { "id": 310, "url": "http://patches.dpdk.org/api/users/310/?format=api", "username": "jerin", "first_name": "Jerin", "last_name": "Jacob", "email": "jerinj@marvell.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/1619163488-63913-1-git-send-email-humin29@huawei.com/mbox/", "series": [ { "id": 16618, "url": "http://patches.dpdk.org/api/series/16618/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=16618", "date": "2021-04-23T07:38:08", "name": "app/testeventdev: fix buffer overflow", "version": 1, "mbox": "http://patches.dpdk.org/series/16618/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/92053/comments/", "check": "success", "checks": "http://patches.dpdk.org/api/patches/92053/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from mails.dpdk.org (mails.dpdk.org [217.70.189.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id 433F7A0548;\n\tFri, 23 Apr 2021 09:38:14 +0200 (CEST)", "from [217.70.189.124] (localhost [127.0.0.1])\n\tby mails.dpdk.org (Postfix) with ESMTP id BECEA4067E;\n\tFri, 23 Apr 2021 09:38:13 +0200 (CEST)", "from szxga04-in.huawei.com (szxga04-in.huawei.com [45.249.212.190])\n by mails.dpdk.org (Postfix) with ESMTP id EF03B4014F\n for <dev@dpdk.org>; Fri, 23 Apr 2021 09:38:11 +0200 (CEST)", "from DGGEMS414-HUB.china.huawei.com (unknown [172.30.72.58])\n by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4FRR0T62F8z1BH9K;\n Fri, 23 Apr 2021 15:35:37 +0800 (CST)", "from localhost.localdomain (10.69.192.56) by\n DGGEMS414-HUB.china.huawei.com (10.3.19.214) with Microsoft SMTP Server id\n 14.3.498.0; Fri, 23 Apr 2021 15:37:58 +0800" ], "From": "\"Min Hu (Connor)\" <humin29@huawei.com>", "To": "<dev@dpdk.org>", "CC": "<ferruh.yigit@intel.com>, <jerinj@marvell.com>, <thomas@monjalon.net>", "Date": "Fri, 23 Apr 2021 15:38:08 +0800", "Message-ID": "<1619163488-63913-1-git-send-email-humin29@huawei.com>", "X-Mailer": "git-send-email 2.7.4", "MIME-Version": "1.0", "Content-Type": "text/plain", "X-Originating-IP": "[10.69.192.56]", "X-CFilter-Loop": "Reflected", "Subject": "[dpdk-dev] [PATCH] app/testeventdev: fix buffer overflow", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "Tainted and unvalidated integer 'idx' used as an index, which may\nlead to buffer overflow.\n\nThis patch fixed it.\n\nFixes: 89e5eb118017 (\"app/testeventdev: add string parsing helpers\")\nCc: stable@dpdk.org\n\nSigned-off-by: Min Hu (Connor) <humin29@huawei.com>\n---\n app/test-eventdev/evt_options.c | 4 ++--\n app/test-eventdev/parser.c | 6 ++++--\n app/test-eventdev/parser.h | 2 +-\n 3 files changed, 7 insertions(+), 5 deletions(-)", "diff": "diff --git a/app/test-eventdev/evt_options.c b/app/test-eventdev/evt_options.c\nindex 0d55405..061b63e 100644\n--- a/app/test-eventdev/evt_options.c\n+++ b/app/test-eventdev/evt_options.c\n@@ -221,7 +221,7 @@ evt_parse_plcores(struct evt_options *opt, const char *corelist)\n {\n \tint ret;\n \n-\tret = parse_lcores_list(opt->plcores, corelist);\n+\tret = parse_lcores_list(opt->plcores, RTE_MAX_LCORE, corelist);\n \tif (ret == -E2BIG)\n \t\tevt_err(\"duplicate lcores in plcores\");\n \n@@ -233,7 +233,7 @@ evt_parse_work_lcores(struct evt_options *opt, const char *corelist)\n {\n \tint ret;\n \n-\tret = parse_lcores_list(opt->wlcores, corelist);\n+\tret = parse_lcores_list(opt->wlcores, RTE_MAX_LCORE, corelist);\n \tif (ret == -E2BIG)\n \t\tevt_err(\"duplicate lcores in wlcores\");\n \ndiff --git a/app/test-eventdev/parser.c b/app/test-eventdev/parser.c\nindex 24f1855..7a973cb 100644\n--- a/app/test-eventdev/parser.c\n+++ b/app/test-eventdev/parser.c\n@@ -310,7 +310,7 @@ parse_hex_string(char *src, uint8_t *dst, uint32_t *size)\n }\n \n int\n-parse_lcores_list(bool lcores[], const char *corelist)\n+parse_lcores_list(bool lcores[], int lcores_num, const char *corelist)\n {\n \tint i, idx = 0;\n \tint min, max;\n@@ -332,6 +332,8 @@ parse_lcores_list(bool lcores[], const char *corelist)\n \t\tif (*corelist == '\\0')\n \t\t\treturn -1;\n \t\tidx = strtoul(corelist, &end, 10);\n+\t\tif (idx < 0 || idx > lcores_num)\n+\t\t\treturn -1;\n \n \t\tif (end == NULL)\n \t\t\treturn -1;\n@@ -343,7 +345,7 @@ parse_lcores_list(bool lcores[], const char *corelist)\n \t\t\tmax = idx;\n \t\t\tif (min == RTE_MAX_LCORE)\n \t\t\t\tmin = idx;\n-\t\t\tfor (idx = min; idx <= max; idx++) {\n+\t\t\tfor (idx = min; idx < max; idx++) {\n \t\t\t\tif (lcores[idx] == 1)\n \t\t\t\t\treturn -E2BIG;\n \t\t\t\tlcores[idx] = 1;\ndiff --git a/app/test-eventdev/parser.h b/app/test-eventdev/parser.h\nindex 673ff22..696b40a 100644\n--- a/app/test-eventdev/parser.h\n+++ b/app/test-eventdev/parser.h\n@@ -46,5 +46,5 @@ int parse_hex_string(char *src, uint8_t *dst, uint32_t *size);\n \n int parse_tokenize_string(char *string, char *tokens[], uint32_t *n_tokens);\n \n-int parse_lcores_list(bool lcores[], const char *corelist);\n+int parse_lcores_list(bool lcores[], int lcores_num, const char *corelist);\n #endif\n", "prefixes": [] }