Bug 1455625

Summary:	[fdBeta] openvswitch: unsigned integer underflow in ofputil_pull_queue_get_config_reply10
Product:	Red Hat Enterprise Linux 7	Reporter:	Timothy Redaelli <tredaelli>
Component:	openvswitch	Assignee:	Timothy Redaelli <tredaelli>
Status:	CLOSED ERRATA	QA Contact:	Junhan <juyan>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	atragler, qding, rhartman
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openvswitch-2.7.0-6.git20170530.el7fdb	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-07-12 15:54:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1456795

Description Timothy Redaelli 2017-05-25 15:47:49 UTC

In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.

Comment 4 Junhan 2017-06-07 07:01:09 UTC

Tested openvswitch topo with the openvswitch-2.7.0-6.git20170530.el7fdb,
the result is pass.
Related job:
https://beaker.engineering.redhat.com/jobs/1892239