proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-07-27 10:04:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #16504 from FRRouting/mergify/bp/stable/9.1/pr-16497

Browse Source 
bgpd: Check the actual remaining stream length before taking TLV value (backport #16497)
This commit is contained in:
Donald Sharp 2024-07-31 12:34:37 -04:00 committed by GitHub
commit 3f6b0281f0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
bgpd/bgp_attr.c
View File

@ -2730,6 +2730,14 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
args->total); args->total);
} }
if (STREAM_READABLE(BGP_INPUT(peer)) < sublength) {
zlog_err("Tunnel Encap attribute sub-tlv length %d exceeds remaining stream length %zu",
sublength, STREAM_READABLE(BGP_INPUT(peer)));
return bgp_attr_malformed(args,
BGP_NOTIFY_UPDATE_OPT_ATTR_ERR,
args->total);
}
/* alloc and copy sub-tlv */ /* alloc and copy sub-tlv */
/* TBD make sure these are freed when attributes are released */ /* TBD make sure these are freed when attributes are released */
tlv = XCALLOC(MTYPE_ENCAP_TLV, tlv = XCALLOC(MTYPE_ENCAP_TLV,