proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-05 18:42:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: fix last_reset_cause setup

Browse Source 
last_reset_cause_size is the length *used* in last_reset_cause[].  It's
straight up used wrong here; we're saving off a reset cause and need to
check against the *available* size in last_reset_cause[].

This could actually have led to (hopefully rare) crashes in the assert
there, since the assert condition might fail incorrectly.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
This commit is contained in:
David Lamparter 2019-04-24 20:14:19 +02:00
parent 611349b99f
commit 1a1f453436
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bgpd/bgp_packet.c
View File

@ -681,9 +681,9 @@ void bgp_notify_send_with_data(struct peer *peer, uint8_t code,
* in place because we are sometimes called with a doppelganger peer,
* who tends to have a plethora of fields nulled out.
*/
if (peer->curr && peer->last_reset_cause_size) {
if (peer->curr) {
size_t packetsize = stream_get_endp(peer->curr);
assert(packetsize <= peer->last_reset_cause_size);
assert(packetsize <= sizeof(peer->last_reset_cause));
memcpy(peer->last_reset_cause, peer->curr->data, packetsize);
peer->last_reset_cause_size = packetsize;
}

4
bgpd/bgpd.h
View File

@ -1153,7 +1153,7 @@ struct peer {
unsigned long weight[AFI_MAX][SAFI_MAX];
/* peer reset cause */
char last_reset;
uint8_t last_reset;
#define PEER_DOWN_RID_CHANGE 1 /* bgp router-id command */
#define PEER_DOWN_REMOTE_AS_CHANGE 2 /* neighbor remote-as command */
#define PEER_DOWN_LOCAL_AS_CHANGE 3 /* neighbor local-as command */
@ -1180,7 +1180,7 @@ struct peer {
#define PEER_DOWN_BFD_DOWN 24 /* BFD down */
#define PEER_DOWN_IF_DOWN 25 /* Interface down */
#define PEER_DOWN_NBR_ADDR_DEL 26 /* Peer address lost */
unsigned long last_reset_cause_size;
size_t last_reset_cause_size;
uint8_t last_reset_cause[BGP_MAX_PACKET_SIZE];
/* The kind of route-map Flags.*/