proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-04-30 22:26:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: Ensure FRR has enough data to read 2 bytes in peek_for_as4_capability

Browse Source 
In peek_for_as4_capability the code is checking that the
stream has at least 2 bytes to read ( the opt_type and the
opt_length ).  However if BGP_OPEN_EXT_OPT_PARAMS_CAPABLE(peer)
is configured then FRR is reading 3 bytes.  Which is not good
since the packet could be badly formated.  Ensure that
FRR has the appropriate data length to read the data.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
This commit is contained in:
Donald Sharp 2022-09-30 08:51:45 -04:00
parent 5ae96447d7
commit 3e46b43e37
1 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
bgpd/bgp_open.c
View File

@ -1185,15 +1185,30 @@ as_t peek_for_as4_capability(struct peer *peer, uint16_t length)
uint8_t opt_type; uint8_t opt_type;
uint16_t opt_length; uint16_t opt_length;
/* Check the length. */ /* Ensure we can read the option type */
if (stream_get_getp(s) + 1 > end)
goto end;
/* Fetch the option type */
opt_type = stream_getc(s);
/*
* Check the length and fetch the opt_length
* If the peer is BGP_OPEN_EXT_OPT_PARAMS_CAPABLE(peer)
* then we do a getw which is 2 bytes. So we need to
* ensure that we can read that as well
*/
if (BGP_OPEN_EXT_OPT_PARAMS_CAPABLE(peer)) {
if (stream_get_getp(s) + 2 > end) if (stream_get_getp(s) + 2 > end)
goto end; goto end;
/* Fetch option type and length. */ opt_length = stream_getw(s);
opt_type = stream_getc(s); } else {
opt_length = BGP_OPEN_EXT_OPT_PARAMS_CAPABLE(peer) if (stream_get_getp(s) + 1 > end)
? stream_getw(s) goto end;
: stream_getc(s);
opt_length = stream_getc(s);
}
/* Option length check. */ /* Option length check. */
if (stream_get_getp(s) + opt_length > end) if (stream_get_getp(s) + opt_length > end)