- do
- {
- u32 dst_free = buffer_size - dst_off;
- if (dst_free == 0)
- {
- dst_off = 0;
- dst_free = buffer_size;
- n_buffers++;
- }
- u32 bytes_to_copy = clib_min (dst_free, n_bytes_left);
- memif_add_copy_op (ptd, mb0 + src_off, bytes_to_copy, dst_off,
- n_buffers - 1);
- n_bytes_left -= bytes_to_copy;
- src_off += bytes_to_copy;
- dst_off += bytes_to_copy;
- }
- while (PREDICT_FALSE (n_bytes_left));
+ if (PREDICT_FALSE (mb0 + n_bytes_left > last_region_max))
+ vlib_error_count (vm, node->node_index, MEMIF_INPUT_ERROR_BAD_DESC, 1);
+ else
+ do
+ {
+ u32 dst_free = buffer_size - dst_off;
+ if (dst_free == 0)
+ {
+ dst_off = 0;
+ dst_free = buffer_size;
+ n_buffers++;
+ }
+ u32 bytes_to_copy = clib_min (dst_free, n_bytes_left);
+ memif_add_copy_op (ptd, mb0 + src_off, bytes_to_copy, dst_off,
+ n_buffers - 1);
+ n_bytes_left -= bytes_to_copy;
+ src_off += bytes_to_copy;
+ dst_off += bytes_to_copy;
+ }
+ while (PREDICT_FALSE (n_bytes_left));