Fix PropExperimenter deserialization out-of-bounds read

Signed-off-by: Aidar Fattakhov <[email protected]>
antrea-io · Nov 22, 2024 · dc644eb · dc644eb
1 parent 009740f
commit dc644eb
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/openflow15/group.go b/openflow15/group.go
@@ -162,7 +162,7 @@ func (g *GroupMod) UnmarshalBinary(data []byte) (err error) {
 	g.CommandBucketId = binary.BigEndian.Uint32(data[n:])
 	n += 4
 
-	for n < g.Header.Length {
+	for len(g.Buckets) < int(g.BucketArrayLen) && n < g.Header.Length {
 		bkt := new(Bucket)
 		err = bkt.UnmarshalBinary(data[n:])
 		if err != nil {

diff --git a/openflow15/openflow15.go b/openflow15/openflow15.go
@@ -1516,7 +1516,7 @@ func (p *PropExperimenter) Len() uint16 {
 
 func (p *PropExperimenter) MarshalBinary() (data []byte, err error) {
 	data = make([]byte, int(p.Len()))
-	p.Header.Length = 8 + uint16(len(p.Data)*4)
+	p.Header.Length = p.Header.Len() + 8 + uint16(len(p.Data)*4)
 	b, err := p.Header.MarshalBinary()
 	if err != nil {
 		return
@@ -1547,7 +1547,7 @@ func (p *PropExperimenter) UnmarshalBinary(data []byte) (err error) {
 	p.ExpType = binary.BigEndian.Uint32(data[n:])
 	n += 4
 
-	for n < p.Header.Length+p.Header.Len() {
+	for n < p.Header.Length {
 		d := binary.BigEndian.Uint32(data[n:])
 		p.Data = append(p.Data, d)
 		n += 4