memif: crash on recceiving a bad descriptor

[vpp.git] / src / plugins / memif / node.c

diff --git a/src/plugins/memif/node.c b/src/plugins/memif/node.c
index 5bb10fc..5abd20a 100644 (file)
--- a/src/plugins/memif/node.c
+++ b/src/plugins/memif/node.c
@@ -223,9 +223,9 @@ memif_validate_desc_data (memif_per_thread_data_t *ptd, memif_if_t *mif,
          desc_data[i] = r->shm + offset;
          if (len > max_len)
            max_len = len;
-         xor_status |= desc_status[i].as_u8;
          n_rx_bytes += len;
        }
+      xor_status |= desc_status[i].as_u8;
     }
 
   ptd->max_desc_len = max_len;
@@ -247,7 +247,7 @@ memif_process_desc (vlib_main_t *vm, vlib_node_runtime_t *node,
   u32 n_buffers = 0;
   u32 n_left = ptd->n_packets;
   u32 packet_len;
-  int i = 0;
+  int i = -1;
 
   /* construct copy and packet vector out of ring slots */
   while (n_left)
@@ -261,6 +261,7 @@ memif_process_desc (vlib_main_t *vm, vlib_node_runtime_t *node,
       dst_off = start_offset;
 
     next_slot:
+      i++; /* next descriptor */
       n_bytes_left = desc_len[i];
 
       packet_len += n_bytes_left;
@@ -287,9 +288,6 @@ memif_process_desc (vlib_main_t *vm, vlib_node_runtime_t *node,
          }
        while (PREDICT_FALSE (n_bytes_left));
 
-      /* next descriptor */
-      i++;
-
       if (desc_status[i].next)
        {
          src_off = 0;