From 2a3d41cea2b854aec11871719eb6bb967089ad33 Mon Sep 17 00:00:00 2001 From: Florin Coras Date: Thu, 2 Feb 2023 20:07:19 -0800 Subject: [PATCH] session: fix out of bounds event memcpy Type: fix Signed-off-by: Florin Coras Change-Id: If5300653edd2dad470985f4591959d00cad2a43b (cherry picked from commit af2e88d964ff8bd8eca30c182ab00e178213c1d4) --- src/vnet/session/session_debug.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/vnet/session/session_debug.c b/src/vnet/session/session_debug.c index a6c4adb2bdc..dba4ef36fb8 100644 --- a/src/vnet/session/session_debug.c +++ b/src/vnet/session/session_debug.c @@ -302,7 +302,6 @@ session_node_lookup_fifo_event (svm_fifo_t * f, session_event_t * e) session_worker_t *wrk; int i, index, found = 0; svm_msg_q_msg_t *msg; - svm_msg_q_ring_t *ring; svm_msg_q_t *mq; u8 thread_index; @@ -319,8 +318,7 @@ session_node_lookup_fifo_event (svm_fifo_t * f, session_event_t * e) for (i = 0; i < sq->cursize; i++) { msg = (svm_msg_q_msg_t *) (&sq->data[0] + sq->elsize * index); - ring = svm_msg_q_ring (mq, msg->ring_index); - clib_memcpy_fast (e, svm_msg_q_msg_data (mq, msg), ring->elsize); + clib_memcpy_fast (e, svm_msg_q_msg_data (mq, msg), sizeof (*e)); found = session_node_cmp_event (e, f); if (found) return 1; -- 2.16.6