[ofa-general] [PATCH] libibmad/mad.c: Validate DR hop count for SMPs and handle errors

[Hal Rosenstock]

In mad_encode, validate DR hop count for SMPs
In mad_build_pkt, handle mad_encode error

Signed-off-by: Hal Rosenstock <hal.rosenstock at gmail.com>
---
diff --git a/libibmad/src/mad.c b/libibmad/src/mad.c
index 3f04da0..89ff978 100644
--- a/libibmad/src/mad.c
+++ b/libibmad/src/mad.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004-2007 Voltaire Inc.  All rights reserved.
+ * Copyright (c) 2009 HNR Consulting.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -79,6 +80,10 @@ void *mad_encode(void *buf, ib_rpc_t * rpc, ib_dr_path_t * drpath, void *data)
 			IBWARN("encoding dr mad without drpath (null)");
 			return 0;
 		}
+		if (drpath->cnt >= IB_SUBNET_PATH_HOPS_MAX) {
+			IBWARN("dr path with hop count %d", drpath->cnt);
+			return 0;
+		}
 		mad_set_field(buf, 0, IB_DRSMP_HOPCNT_F, drpath->cnt);
 		mad_set_field(buf, 0, IB_DRSMP_HOPPTR_F,
 			      is_resp ? drpath->cnt + 1 : 0x0);
@@ -157,6 +162,8 @@ int mad_build_pkt(void *umad, ib_rpc_t * rpc, ib_portid_t * dport,
 
 	mad = umad_get_mad(umad);
 	p = mad_encode(mad, rpc, lid_routed ? 0 : &dport->drpath, data);
+	if (!p)
+		return -1;
 
 	if (!is_smi && rmpp) {
 		mad_set_field(mad, 0, IB_SA_RMPP_VERS_F, 1);