From patchwork Mon Mar 9 13:21:09 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Julien Cretin X-Patchwork-Id: 3937 Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [IPv6:::1]) by dpdk.org (Postfix) with ESMTP id 28CFA683D; Mon, 9 Mar 2015 14:21:45 +0100 (CET) Received: from ex.trust-in-soft.com (ex.trust-in-soft.com [188.165.147.96]) by dpdk.org (Postfix) with ESMTP id 836625FEB for ; Mon, 9 Mar 2015 14:21:43 +0100 (CET) Received: from localhost.localdomain (84.14.219.2) by S1688.EX1688.lan (2001:41d0:6b:b00::bca5:9360) with Microsoft SMTP Server (TLS) id 15.0.712.22; Mon, 9 Mar 2015 14:21:33 +0100 From: Julien Cretin To: Date: Mon, 9 Mar 2015 14:21:09 +0100 Message-ID: <1425907269-20856-1-git-send-email-julien.cretin@trust-in-soft.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-Originating-IP: [84.14.219.2] X-ClientProxiedBy: S1688.EX1688.lan (2001:41d0:6b:b00::bca5:9360) To S1688.EX1688.lan (2001:41d0:6b:b00::bca5:9360) Subject: [dpdk-dev] [PATCH] app/testpmd: fix potential out of bounds read X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" After the last enabled port has been seen, and the last time we evaluate the loop condition, there is an out of bounds read in ports[p].enabled because p is equal to size, which is the length of ports. Signed-off-by: Julien Cretin Acked-by: Thomas Monjalon --- app/test-pmd/testpmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c index 3e1327e..a9d15f3 100644 --- a/app/test-pmd/testpmd.c +++ b/app/test-pmd/testpmd.c @@ -333,7 +333,7 @@ find_next_port(portid_t p, struct rte_port *ports, int size) if (ports == NULL) rte_exit(-EINVAL, "failed to find a next port id\n"); - while ((ports[p].enabled == 0) && (p < size)) + while ((p < size) && (ports[p].enabled == 0)) p++; return p; }