[PATCH 1/3] app/testpmd: fix stack overflow parsing flex item link
From: Stephen Hemminger <stephen@networkplumber.org>
Date: 2026-09-07 18:26:17
Subsystem:
the rest · Maintainer:
Linus Torvalds
The item string in a flex item JSON configuration is formatted into a
256 byte stack buffer with sprintf(). A longer string overflows it:
*** buffer overflow detected ***: terminated
Use snprintf() and reject the item if it does not fit.
Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")
Cc: stable@dpdk.org
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
app/test-pmd/cmd_flex_item.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/app/test-pmd/cmd_flex_item.c b/app/test-pmd/cmd_flex_item.c
index c0bbff7b45..e62afe3cb5 100644
--- a/app/test-pmd/cmd_flex_item.c
+++ b/app/test-pmd/cmd_flex_item.c@@ -135,10 +135,13 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item) struct rte_flow_item *pattern; struct rte_flow_action *actions; - sprintf(flow_rule, - "flow create 0 pattern %s / end actions drop / end", src); - src = flow_rule; - ret = flow_parse(src, (void *)data, sizeof(data), + ret = snprintf(flow_rule, sizeof(flow_rule), + "flow create 0 pattern %s / end actions drop / end", src); + if (ret < 0 || ret >= (int)sizeof(flow_rule)) { + printf("Flex item link \"%s\" is too long\n", src); + return -ENOSPC; + } + ret = flow_parse(flow_rule, (void *)data, sizeof(data), &attr, &pattern, &actions); if (ret) return ret;
--
2.53.0