ofproto: Avoid use-after-free on error path in ofproto_flow_mod_learn().
In the case where the learned flow limit has been reached (below_limit == false), ofproto_flow_mod_uninit() would unref ofm->temp_rule (which is also in the 'rule' local variable) before dereferencing rule->flow_cookie for the log message. This fixes the problem. (The greatest likely consequence of this bug was logging the wrong cookie value.) Signed-off-by: Ben Pfaff <email@example.com> Acked-by: William Tu <firstname.lastname@example.org>
Showing with 4 additions and 6 deletions