proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-04-29 21:37:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lib: cli: don't run off graph "pre-end"

Browse Source 
Behind END_TKN, there is another graph node whose data pointer is
actually struct cmd_element instead of struct cmd_token.  Don't try to
interpret that as cmd_token.  This causes very interesting crashes when
ASLR decides to give one of the strings of a command definition a lower
32-bit value that is a valid cmd_token_type (e.g. FORK_TKN).

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
This commit is contained in:
David Lamparter 2017-08-07 15:05:34 +02:00
parent 9b0a8efa46
commit 5225e155d3
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/command_graph.c
View File

@ -385,7 +385,6 @@ static void cmd_node_names(struct graph_node *gn, struct graph_node *join,
break;
case START_TKN:
case END_TKN:
case JOIN_TKN:
/* "<foo|bar> WORD" -> word is not "bar" or "foo" */
prevname = NULL;
@ -405,6 +404,9 @@ static void cmd_node_names(struct graph_node *gn, struct graph_node *join,
cmd_token_varname_set(tailtok, jointok->varname);
}
break;
case END_TKN:
return;
}
for (i = 0; i < vector_active(gn->to); i++) {