[PATCH 22.11] app/testpmd: fix flex item link parsing

[Maayan Kashani]

[ upstream commit 39454e245b ]

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH
for all memcpy operations regardless of the actual flow item type. This
could lead to copying incorrect amounts of data.

This patch enlarge data buffer to avoid the buffer overflow while
continue to report same buffer size to flow parse.

Fixes: 59f3a8a ("app/testpmd: add flex item commands")
Cc: stable at dpdk.org

Signed-off-by: Maayan Kashani <mkashani at nvidia.com>
---
 app/test-pmd/cmd_flex_item.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/app/test-pmd/cmd_flex_item.c b/app/test-pmd/cmd_flex_item.c
index e6e1cefeb3d..a799b31ffd7 100644
--- a/app/test-pmd/cmd_flex_item.c
+++ b/app/test-pmd/cmd_flex_item.c
@@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	struct rte_flow_attr *attr;
 	struct rte_flow_item *pattern;
 	struct rte_flow_action *actions;
+	size_t sz;
 
 	sprintf(flow_rule,
 		"flow create 0 pattern %s / end actions drop / end", src);
@@ -143,21 +144,38 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	if (ret)
 		return ret;
 	item->type = pattern->type;
+	switch (item->type) {
+	case RTE_FLOW_ITEM_TYPE_IPV4:
+		sz = sizeof(struct rte_flow_item_ipv4);
+	break;
+	case RTE_FLOW_ITEM_TYPE_IPV6:
+		sz = sizeof(struct rte_flow_item_ipv6);
+	break;
+	case RTE_FLOW_ITEM_TYPE_UDP:
+		sz = sizeof(struct rte_flow_item_udp);
+       break;
+	case RTE_FLOW_ITEM_TYPE_TCP:
+		sz = sizeof(struct rte_flow_item_tcp);
+	break;
+	default:
+		printf("Unsupported item type in specified in link\n");
+		return -EINVAL;
+	}
 	if (pattern->spec) {
 		ptr = (void *)(uintptr_t)item->spec;
-		memcpy(ptr, pattern->spec, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->spec, sz);
 	} else {
 		item->spec = NULL;
 	}
 	if (pattern->mask) {
 		ptr = (void *)(uintptr_t)item->mask;
-		memcpy(ptr, pattern->mask, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->mask, sz);
 	} else {
 		item->mask = NULL;
 	}
 	if (pattern->last) {
 		ptr = (void *)(uintptr_t)item->last;
-		memcpy(ptr, pattern->last, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->last, sz);
 	} else {
 		item->last = NULL;
 	}
-- 
2.25.1