proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-07-25 09:28:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ospfd: Fix heap corruption vulnerability when parsing SR-Algorithm TLV

Browse Source 
When parsing the SR-Algorithm TLV in the OSPF Router Information Opaque
LSA, assure that not more than the maximum number of supported
algorithms are copied from the TLV.

Signed-off-by: Acee Lindem <acee@lindem.com>
(cherry picked from commit 0dc969185f)
This commit is contained in:
Acee Lindem 2024-09-18 18:09:19 +00:00 committed by Mergify
parent 3d5b074bb6
commit 122f4ac4b9
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ospfd/ospf_sr.c
View File

@ -1459,7 +1459,8 @@ void ospf_sr_ri_lsa_update(struct ospf_lsa *lsa)
/* Update Algorithm, SRLB and MSD if present */
if (algo != NULL) {
int i;
for (i = 0; i < ntohs(algo->header.length); i++)
for (i = 0;
i < ntohs(algo->header.length) && i < ALGORITHM_COUNT; i++)
srn->algo[i] = algo->value[0];
for (; i < ALGORITHM_COUNT; i++)
srn->algo[i] = SR_ALGORITHM_UNSET;