VPP-933 VPP crashes when deleting an ARP entry

When attempting to delete an ARP entry on an interface
that hasn't had any ARP entries added yet, VPP was
retrieving an array element at an index that was out of
bounds and trying to dereference it.

Change-Id: Id141d3bfd8378dd8dd63f43b0b4b41461c285a4f
Signed-off-by: Matthew Smith <mgsmith@netgate.com>

diff --git a/src/vnet/ethernet/arp.c b/src/vnet/ethernet/arp.c
index c8d1578..c22be3f 100644 (file)
--- a/src/vnet/ethernet/arp.c
+++ b/src/vnet/ethernet/arp.c
@@ -1635,6 +1635,9 @@ vnet_arp_unset_ip4_over_ethernet_internal (vnet_main_t * vnm,
   ethernet_arp_ip4_entry_t *e;
   ethernet_arp_interface_t *eai;
 
+  if (vec_len (am->ethernet_arp_by_sw_if_index) <= args->sw_if_index)
+    return 0;
+
   eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index];
 
   e = arp_entry_find (eai, &args->a.ip4);
@@ -1659,6 +1662,9 @@ vnet_arp_flush_ip4_over_ethernet_internal (vnet_main_t * vnm,
   ethernet_arp_ip4_entry_t *e;
   ethernet_arp_interface_t *eai;
 
+  if (vec_len (am->ethernet_arp_by_sw_if_index) <= args->sw_if_index)
+    return 0;
+
   eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index];
 
   e = arp_entry_find (eai, &args->a.ip4);
@@ -1692,6 +1698,7 @@ vnet_arp_populate_ip4_over_ethernet_internal (vnet_main_t * vnm,
   ethernet_arp_ip4_entry_t *e;
   ethernet_arp_interface_t *eai;
 
+  vec_validate (am->ethernet_arp_by_sw_if_index, args->sw_if_index);
   eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index];
 
   e = arp_entry_find (eai, &args->a.ip4);