memif: crash on recceiving a bad descriptor

[vpp.git] / src / plugins / memif / node.c

diff --git a/src/plugins/memif/node.c b/src/plugins/memif/node.c
index 1f636f2..5abd20a 100644 (file)
--- a/src/plugins/memif/node.c
+++ b/src/plugins/memif/node.c
@@ -223,9 +223,9 @@ memif_validate_desc_data (memif_per_thread_data_t *ptd, memif_if_t *mif,
          desc_data[i] = r->shm + offset;
          if (len > max_len)
            max_len = len;
-         xor_status |= desc_status[i].as_u8;
          n_rx_bytes += len;
        }
+      xor_status |= desc_status[i].as_u8;
     }
 
   ptd->max_desc_len = max_len;
@@ -247,7 +247,7 @@ memif_process_desc (vlib_main_t *vm, vlib_node_runtime_t *node,
   u32 n_buffers = 0;
   u32 n_left = ptd->n_packets;
   u32 packet_len;
-  int i = 0;
+  int i = -1;
 
   /* construct copy and packet vector out of ring slots */
   while (n_left)
@@ -261,6 +261,7 @@ memif_process_desc (vlib_main_t *vm, vlib_node_runtime_t *node,
       dst_off = start_offset;
 
     next_slot:
+      i++; /* next descriptor */
       n_bytes_left = desc_len[i];
 
       packet_len += n_bytes_left;
@@ -287,9 +288,6 @@ memif_process_desc (vlib_main_t *vm, vlib_node_runtime_t *node,
          }
        while (PREDICT_FALSE (n_bytes_left));
 
-      /* next descriptor */
-      i++;
-
       if (desc_status[i].next)
        {
          src_off = 0;
@@ -557,7 +555,7 @@ memif_device_input_inline (vlib_main_t *vm, vlib_node_runtime_t *node,
 
       vlib_get_buffers (vm, ptd->buffers, buffer_ptrs, n_buffers);
 
-      for (i = 0; i < n_pkts - 8; i++)
+      for (i = 0; i + 8 < n_pkts; i++)
        {
          clib_prefetch_load (desc_data[i + 8]);
          clib_prefetch_store (buffer_ptrs[i + 8]->data);
@@ -574,7 +572,7 @@ memif_device_input_inline (vlib_main_t *vm, vlib_node_runtime_t *node,
       u32 n_pkts = vec_len (ptd->copy_ops);
       co = ptd->copy_ops;
 
-      for (i = 0; i < n_pkts - 8; i++)
+      for (i = 0; i + 8 < n_pkts; i++)
        {
          clib_prefetch_load (co[i + 8].data);
          b = vlib_get_buffer (vm, ptd->buffers[co[i].buffer_vec_index]);