proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-04-28 23:33:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pimd: fix MSDP packet debug crashes

Browse Source 
Add some safe guards to avoid crashes and alert us about programming
errors in packet build.

Signed-off-by: Rafael Zalamena <rzalamena@opensourcerouting.org>
This commit is contained in:
Rafael Zalamena 2022-12-07 11:49:26 -03:00
parent d49810329d
commit 1dd422a22b
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
pimd/pim_msdp_packet.c
View File

@ -83,10 +83,18 @@ static void pim_msdp_pkt_sa_dump_one(struct stream *s)
static void pim_msdp_pkt_sa_dump(struct stream *s) static void pim_msdp_pkt_sa_dump(struct stream *s)
{ {
const size_t header_length = PIM_MSDP_SA_X_SIZE - PIM_MSDP_HEADER_SIZE;
size_t payload_length;
int entry_cnt; int entry_cnt;
int i; int i;
struct in_addr rp; /* Last RP address associated with this SA */ struct in_addr rp; /* Last RP address associated with this SA */
if (header_length > STREAM_READABLE(s)) {
zlog_err("BUG MSDP SA bad header (readable %zu expected %zu)",
STREAM_READABLE(s), header_length);
return;
}
entry_cnt = stream_getc(s); entry_cnt = stream_getc(s);
rp.s_addr = stream_get_ipv4(s); rp.s_addr = stream_get_ipv4(s);
@ -96,6 +104,13 @@ static void pim_msdp_pkt_sa_dump(struct stream *s)
zlog_debug(" entry_cnt %d rp %s", entry_cnt, rp_str); zlog_debug(" entry_cnt %d rp %s", entry_cnt, rp_str);
} }
payload_length = (size_t)entry_cnt * PIM_MSDP_SA_ONE_ENTRY_SIZE;
if (payload_length > STREAM_READABLE(s)) {
zlog_err("BUG MSDP SA bad length (readable %zu expected %zu)",
STREAM_READABLE(s), payload_length);
return;
}
/* dump SAs */ /* dump SAs */
for (i = 0; i < entry_cnt; ++i) { for (i = 0; i < entry_cnt; ++i) {
pim_msdp_pkt_sa_dump_one(s); pim_msdp_pkt_sa_dump_one(s);
@ -116,6 +131,11 @@ static void pim_msdp_pkt_dump(struct pim_msdp_peer *mp, int type, int len,
return; return;
} }
if (len < PIM_MSDP_HEADER_SIZE) {
zlog_err("invalid MSDP header length");
return;
}
switch (type) { switch (type) {
case PIM_MSDP_V4_SOURCE_ACTIVE: case PIM_MSDP_V4_SOURCE_ACTIVE:
pim_msdp_pkt_sa_dump(s); pim_msdp_pkt_sa_dump(s);