commit f363ebd4e7cd60dada11daa0e61b64569a9e1cf6
author Neale Ranns <nranns@cisco.com> Wed Dec 06 00:45:33 2017 -0800
committer Damjan Marion <dmarion.lists@gmail.com> Wed Dec 06 19:40:06 2017 +0000
tree f197d40542c46e7b4741d7d8fbfea3934c69ad72
parent 73e4f7965b7f6c0ff3c1217962f76ad586af6332

Label stack size exceeded fix

Change-Id: Ibe2041d83e9b5be16801dc316bd472ae4f6e8c31
Signed-off-by: Neale Ranns <nranns@cisco.com>

src/vnet/dpo/mpls_label_dpo.c

diff --git a/src/vnet/dpo/mpls_label_dpo.c b/src/vnet/dpo/mpls_label_dpo.c
index c6e8dcc..fa5177a 100644
--- a/src/vnet/dpo/mpls_label_dpo.c
+++ b/src/vnet/dpo/mpls_label_dpo.c
@@ -16,6 +16,7 @@
 #include <vnet/ip/ip.h>
 #include <vnet/dpo/mpls_label_dpo.h>
 #include <vnet/mpls/mpls.h>
+#include <vnet/dpo/drop_dpo.h>
 
 /*
  * pool of all MPLS Label DPOs
@@ -53,6 +54,17 @@
     u32 ii;
 
     mld = mpls_label_dpo_alloc();
+
+    if (MPLS_LABEL_DPO_MAX_N_LABELS < vec_len(label_stack))
+    {
+        clib_warning("Label stack size exceeded");
+        dpo_stack(DPO_MPLS_LABEL,
+                  mld->mld_payload_proto,
+                  &mld->mld_dpo,
+                  drop_dpo_get(DPO_PROTO_MPLS));
+        return (mpls_label_dpo_get_index(mld));
+    }
+
     mld->mld_n_labels = vec_len(label_stack);
     mld->mld_n_hdr_bytes = mld->mld_n_labels * sizeof(mld->mld_hdr[0]);
     mld->mld_payload_proto = payload_proto;