proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-07-04 11:10:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ospf6d: Prevent heap-buffer-overflow with unknown type

Browse Source 
When parsing a osf6 grace lsa field and we receive an
unknown tlv type, ospf6d was not incrementing the pointer
to get beyond the tlv.  Leaving a situation where ospf6d
would parse the packet incorrectly.

Signed-off-by: Iggy Frankovic <iggy07@gmail.com>
(cherry picked from commit 826f2510e6)
This commit is contained in:
Iggy Frankovic 2024-05-30 07:59:54 -04:00 committed by Mergify
parent d3aead43ef
commit 359892fada
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ospf6d/ospf6_gr_helper.c
View File

@ -176,6 +176,7 @@ static int ospf6_extract_grace_lsa_fields(struct ospf6_lsa *lsa,
return OSPF6_FAILURE; return OSPF6_FAILURE;
break; break;
default: default:
sum += TLV_SIZE(tlvh);
if (IS_DEBUG_OSPF6_GR) if (IS_DEBUG_OSPF6_GR)
zlog_debug("%s, Ignoring unknown TLV type:%d", zlog_debug("%s, Ignoring unknown TLV type:%d",
__func__, ntohs(tlvh->type)); __func__, ntohs(tlvh->type));