From: Florin Coras <fcoras@cisco.com>
Date: Fri, 3 Feb 2023 04:07:19 +0000 (-0800)
Subject: session: fix out of bounds event memcpy
X-Git-Tag: v23.10-rc0~267
X-Git-Url: https://gerrit.fd.io/r/gitweb?a=commitdiff_plain;h=af2e88d964ff8bd8eca30c182ab00e178213c1d4;p=vpp.git

session: fix out of bounds event memcpy

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: If5300653edd2dad470985f4591959d00cad2a43b
---

diff --git a/src/vnet/session/session_debug.c b/src/vnet/session/session_debug.c
index a6c4adb2bdc..dba4ef36fb8 100644
--- a/src/vnet/session/session_debug.c
+++ b/src/vnet/session/session_debug.c
@@ -302,7 +302,6 @@ session_node_lookup_fifo_event (svm_fifo_t * f, session_event_t * e)
   session_worker_t *wrk;
   int i, index, found = 0;
   svm_msg_q_msg_t *msg;
-  svm_msg_q_ring_t *ring;
   svm_msg_q_t *mq;
   u8 thread_index;
 
@@ -319,8 +318,7 @@ session_node_lookup_fifo_event (svm_fifo_t * f, session_event_t * e)
   for (i = 0; i < sq->cursize; i++)
     {
       msg = (svm_msg_q_msg_t *) (&sq->data[0] + sq->elsize * index);
-      ring = svm_msg_q_ring (mq, msg->ring_index);
-      clib_memcpy_fast (e, svm_msg_q_msg_data (mq, msg), ring->elsize);
+      clib_memcpy_fast (e, svm_msg_q_msg_data (mq, msg), sizeof (*e));
       found = session_node_cmp_event (e, f);
       if (found)
 	return 1;