commit 825fc4892ee7ec3cff83b2754cd921c0157e62f8
author Neale Ranns <nranns@cisco.com> Wed Oct 10 13:27:00 2018 +0000
committer Damjan Marion <dmarion@me.com> Wed Oct 10 16:03:40 2018 +0000
tree d3a46d299253c6dbb24cb07d8d53f45e9e36ef69
parent b9fa29d513bfad0d9f18e8ed8c2da3feaa6d3bf0

Integer underflow and out-of-bounds read (VPP-1442)

Change-Id: Ife2a83b9d7f733f36e0e786ef79edcd394d7c0f9
Signed-off-by: Neale Ranns <nranns@cisco.com>

src/vlib/buffer_node.h

diff --git a/src/vlib/buffer_node.h b/src/vlib/buffer_node.h
index 93ffb1e..35e15a5 100644
--- a/src/vlib/buffer_node.h
+++ b/src/vlib/buffer_node.h
@@ -366,10 +366,15 @@
       n_enqueued = count_trailing_zeros (~bitmap) / 2;
 #else
       u16 x = 0;
-      x |= next_index ^ nexts[1];
-      x |= next_index ^ nexts[2];
-      x |= next_index ^ nexts[3];
-      n_enqueued = (x == 0) ? 4 : 1;
+      if (count + 3 < max)
+	{
+	  x |= next_index ^ nexts[1];
+	  x |= next_index ^ nexts[2];
+	  x |= next_index ^ nexts[3];
+	  n_enqueued = (x == 0) ? 4 : 1;
+	}
+      else
+	n_enqueued = 1;
 #endif
 
       if (PREDICT_FALSE (n_enqueued > max))