[PATCH v4 4/6] ethdev: fix indirect action conversion with short buffer

[Anatoly Burakov]

The second pass of rte_flow_conv_actions() copies indirect action
handles whenever the destination size is nonzero, even if the buffer
does not cover the corresponding action entry. This writes beyond
the caller's buffer when an indirect action follows the last entry
that fits. The same applies to deprecated SHARED actions now that
their handles are preserved in the same branch.

Require the destination size to cover the full action entry before
writing its handle.

Fixes: fb131e295ea8 ("ethdev: fix indirect action conversion")
Cc: stable at dpdk.org

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
---
 lib/ethdev/rte_flow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ethdev/rte_flow.c b/lib/ethdev/rte_flow.c
index e29bcefab0e..cee0acbd568 100644
--- a/lib/ethdev/rte_flow.c
+++ b/lib/ethdev/rte_flow.c
@@ -1054,7 +1054,7 @@ rte_flow_conv_actions(struct rte_flow_action *dst,
 			 * handler. Copy the action handle directly instead
 			 * of duplicating the pointer memory.
 			 */
-			if (size)
+			if (size >= (i + 1) * sizeof(*dst))
 				dst[i].conf = src->conf;
 		} else if (src->conf) {
 			off = RTE_ALIGN_CEIL(off, sizeof(double));
-- 
2.52.0