From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yong Wang Subject: [PATCH] net/e1000: fix memcpy length error Date: Tue, 12 Sep 2017 08:44:00 -0400 Message-ID: <1505220240-30600-1-git-send-email-wang.yong19@zte.com.cn> Cc: dev@dpdk.org, Yong Wang To: wenzhuo.lu@intel.com Return-path: Received: from mxhk.zte.com.cn (mxhk.zte.com.cn [63.217.80.70]) by dpdk.org (Postfix) with ESMTP id 6131C1B53 for ; Tue, 12 Sep 2017 14:57:38 +0200 (CEST) List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" The size of "flex_filter.filter_info.mask" and "filter->mask" is 16 bytes, but the length of memcpy--"RTE_ALIGN(filter->len, sizeof(char)) / sizeof(char)" may reach 128 bytes which may cause array access out of bound. Fix it by replacing "sizeof(char)" by "CHAR_BIT". Signed-off-by: Yong Wang --- drivers/net/e1000/igb_ethdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/e1000/igb_ethdev.c b/drivers/net/e1000/igb_ethdev.c index e4f7a9f..8078a1e 100644 --- a/drivers/net/e1000/igb_ethdev.c +++ b/drivers/net/e1000/igb_ethdev.c @@ -4094,7 +4094,7 @@ static void igbvf_set_vfta_all(struct rte_eth_dev *dev, bool on) flex_filter.filter_info.priority = filter->priority; memcpy(flex_filter.filter_info.dwords, filter->bytes, filter->len); memcpy(flex_filter.filter_info.mask, filter->mask, - RTE_ALIGN(filter->len, sizeof(char)) / sizeof(char)); + RTE_ALIGN(filter->len, CHAR_BIT) / CHAR_BIT); it = eth_igb_flex_filter_lookup(&filter_info->flex_list, &flex_filter.filter_info); -- 1.8.3.1