[DPDK/other Bug 2104] pipeline: table entry parser accepts actions not belonging to the table

[bugzilla@dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=2104

            Bug ID: 2104
           Summary: pipeline: table entry parser accepts actions not
                    belonging to the table
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: major
          Priority: Normal
         Component: other
          Assignee: dev@dpdk.org
          Reporter: stephen@networkplumber.org
  Target Milestone: ---

Found by build with GCC 16 and -fanalyzer flag.

rte_swx_ctl_pipeline_table_entry_read() (lib/pipeline/rte_swx_ctl.c:3131) finds
the action with action_find(ctl, tokens[1]), which searches all pipeline
actions. It does not check that the action is one of the table's actions.
entry->action_data is allocated from table->params.action_data_size (:321), or
left NULL when that is 0. table_entry_action_argument_read() (:2896) then
copies the arguments into it. An entry line naming an action with more argument
bytes than the table allows writes past the buffer, or to NULL.

-- 
You are receiving this mail because:
You are the assignee for the bug.