This patch fixes CVE-2016-2074.

Multiple versions of Open vSwitch are vulnerable to remote buffer

overflow attacks, in which crafted MPLS packets could overflow the

buffer reserved for MPLS labels in an OVS internal data structure.

The MPLS packets that trigger the vulnerability and the potential for

exploitation vary depending on version:

    - Open vSwitch 2.1.x and earlier are not vulnerable.

    - In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be

      exploited for arbitrary remote code execution.

    - In Open vSwitch 2.4.x, the MPLS buffer overflow does not

      obviously lead to a remote code execution exploit, but testing

      shows that it can allow a remote denial of service.  See the

      mitigation section for details.

    - Open vSwitch 2.5.x is not vulnerable.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has

assigned the identifier CVE-2016-2074 to this issue.

In OVS 2.3.x, this fix was applied by changeset:

    f4137393ef2fd23a70d987ee9f89454e25db1700

diff --git a/lib/flow.c b/lib/flow.c

index 9018b66..c565032 100644

--- a/lib/flow.c

+++ b/lib/flow.c

@@ -159,7 +159,7 @@ struct mf_ctx {

 /* Data at 'valuep' may be unaligned. */

 #define miniflow_push_words_(MF, OFS, VALUEP, N_WORDS)          \

-{                                                               \

+if (N_WORDS) {							\

     int ofs32 = (OFS) / 4;                                      \

                                                                         \

     MINIFLOW_ASSERT(MF.data + (N_WORDS) <= MF.end && (OFS) % 4 == 0     \

@@ -210,7 +210,7 @@ parse_mpls(void **datap, size_t *sizep)

             break;

         }

     }

-    return MAX(count, FLOW_MAX_MPLS_LABELS);

+    return MIN(count, FLOW_MAX_MPLS_LABELS);

 }

 static inline ovs_be16