Safety checks for ARP packets

Verify that ARP packets are for IP and that the protocol length is 4
before extracting source/destination IP addresses.

lib/flow.c

@@ -211,8 +211,10 @@ flow_extract(struct ofpbuf *packet, uint16_t in_port, struct flow *flow)
         } else if (flow->dl_type == htons(ETH_TYPE_ARP)) {
             const struct arp_eth_header *arp = pull_arp(&b);
             if (arp) {
-                flow->nw_src = arp->ar_spa;
-                flow->nw_dst = arp->ar_tpa;
+                if (arp->ar_pro == htons(ARP_PRO_IP) && arp->ar_pln == IP_ADDR_LEN) {
+                    flow->nw_src = arp->ar_spa;
+                    flow->nw_dst = arp->ar_tpa;
+                }
                 flow->nw_proto = ntohs(arp->ar_op) && 0xff;
             }
         }

lib/packets.h

@@ -200,6 +200,8 @@ BUILD_ASSERT_DECL(VLAN_ETH_HEADER_LEN == sizeof(struct vlan_eth_header));
 #define IP_IS_FRAGMENT(ip_frag_off) \
         ((ip_frag_off) & htons(IP_MORE_FRAGMENTS | IP_FRAG_OFF_MASK))
 
+#define IP_ADDR_LEN 4
+
 #define IP_HEADER_LEN 20
 struct ip_header {
     uint8_t ip_ihl_ver;