bgpd: Validate maximum length of software version when handling via dynamic caps

We should not allow exceeding the stream's length, and also software version
can't be larger than 64 bytes.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
This commit is contained in:
Donatas Abraitis 2023-09-29 12:13:43 +03:00
parent 3518fe70cb
commit 5e8a8d0ed6

View File

@ -3064,6 +3064,40 @@ static void bgp_dynamic_capability_graceful_restart(uint8_t *pnt, int action,
}
}
static void bgp_dynamic_capability_software_version(uint8_t *pnt, int action,
struct capability_header *hdr,
struct peer *peer)
{
uint8_t *data = pnt + 3;
uint8_t *end = data + hdr->length;
uint8_t len = *data;
char soft_version[BGP_MAX_SOFT_VERSION + 1] = {};
if (action == CAPABILITY_ACTION_SET) {
if (data + len > end) {
zlog_err("%pBP: Received invalid Software Version capability length %d",
peer, len);
return;
}
data++;
if (len > BGP_MAX_SOFT_VERSION)
len = BGP_MAX_SOFT_VERSION;
memcpy(&soft_version, data, len);
soft_version[len] = '\0';
XFREE(MTYPE_BGP_SOFT_VERSION, peer->soft_version);
peer->soft_version = XSTRDUP(MTYPE_BGP_SOFT_VERSION,
soft_version);
SET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV);
} else {
UNSET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV);
XFREE(MTYPE_BGP_SOFT_VERSION, peer->soft_version);
}
}
/**
* Parse BGP CAPABILITY message for peer.
*
@ -3082,7 +3116,6 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
afi_t afi;
iana_safi_t pkt_safi;
safi_t safi;
char soft_version[BGP_MAX_SOFT_VERSION + 1] = {};
const char *capability;
end = pnt + length;
@ -3129,22 +3162,8 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
switch (hdr->code) {
case CAPABILITY_CODE_SOFT_VERSION:
if (action == CAPABILITY_ACTION_SET) {
SET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV);
memcpy(&soft_version, pnt + 3, hdr->length);
soft_version[hdr->length] = '\0';
XFREE(MTYPE_BGP_SOFT_VERSION,
peer->soft_version);
peer->soft_version =
XSTRDUP(MTYPE_BGP_SOFT_VERSION,
soft_version);
} else {
UNSET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV);
XFREE(MTYPE_BGP_SOFT_VERSION,
peer->soft_version);
}
bgp_dynamic_capability_software_version(pnt, action,
hdr, peer);
break;
case CAPABILITY_CODE_MP:
if (hdr->length < sizeof(struct capability_mp_data)) {