proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-05-29 06:29:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #5584 from qlyoung/pim-fix-iph-trust

Browse Source 
pimd: readd iph length checks
This commit is contained in:
Jafar Al-Gharaibeh 2019-12-22 12:45:00 -06:00 committed by GitHub
commit 1a457dcffd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
pimd/pim_igmp.c
View File

@ -478,10 +478,24 @@ int pim_igmp_packet(struct igmp_sock *igmp, char *buf, size_t len)
ip_hlen = ip_hdr->ip_hl << 2; /* ip_hl gives length in 4-byte words */ ip_hlen = ip_hdr->ip_hl << 2; /* ip_hl gives length in 4-byte words */
if (ip_hlen > len) {
zlog_warn(
"IGMP packet header claims size %zu, but we only have %zu bytes",
ip_hlen, len);
return -1;
}
igmp_msg = buf + ip_hlen; igmp_msg = buf + ip_hlen;
msg_type = *igmp_msg;
igmp_msg_len = len - ip_hlen; igmp_msg_len = len - ip_hlen;
if (igmp_msg_len < PIM_IGMP_MIN_LEN) {
zlog_warn("IGMP message size=%d shorter than minimum=%d",
igmp_msg_len, PIM_IGMP_MIN_LEN);
return -1;
}
msg_type = *igmp_msg;
if (PIM_DEBUG_IGMP_PACKETS) { if (PIM_DEBUG_IGMP_PACKETS) {
zlog_debug( zlog_debug(
"Recv IGMP packet from %s to %s on %s: size=%zu ttl=%d msg_type=%d msg_size=%d", "Recv IGMP packet from %s to %s on %s: size=%zu ttl=%d msg_type=%d msg_size=%d",
@ -489,12 +503,6 @@ int pim_igmp_packet(struct igmp_sock *igmp, char *buf, size_t len)
msg_type, igmp_msg_len); msg_type, igmp_msg_len);
} }
if (igmp_msg_len < PIM_IGMP_MIN_LEN) {
zlog_warn("IGMP message size=%d shorter than minimum=%d",
igmp_msg_len, PIM_IGMP_MIN_LEN);
return -1;
}
switch (msg_type) { switch (msg_type) {
case PIM_IGMP_MEMBERSHIP_QUERY: { case PIM_IGMP_MEMBERSHIP_QUERY: {
int max_resp_code = igmp_msg[1]; int max_resp_code = igmp_msg[1];

3
pimd/pim_mroute.c
View File

@ -590,6 +590,9 @@ static int pim_mroute_msg(struct pim_instance *pim, const char *buf,
struct in_addr ifaddr; struct in_addr ifaddr;
struct igmp_sock *igmp; struct igmp_sock *igmp;
if (buf_size < (int)sizeof(struct ip))
return 0;
ip_hdr = (const struct ip *)buf; ip_hdr = (const struct ip *)buf;
if (ip_hdr->ip_p == IPPROTO_IGMP) { if (ip_hdr->ip_p == IPPROTO_IGMP) {