proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-04-28 11:50:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: add some flowspec sanity returns

Browse Source 
If an error is detected in an NLRI, immediately return
an error, when there is a risk of buffer overflow.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
This commit is contained in:
Philippe Guibert 2023-04-28 21:56:19 +02:00
parent 34a8441fe8
commit 9ba97a35a6
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
bgpd/bgp_flowspec_util.c
View File

@ -185,16 +185,23 @@ int bgp_flowspec_ip_address(enum bgp_flowspec_util_nlri_t type,
offset++;
}
/* Prefix length check. */
if (prefix_local.prefixlen > prefix_blen(&prefix_local) * 8)
if (prefix_local.prefixlen > prefix_blen(&prefix_local) * 8) {
*error = -1;
return offset;
}
/* When packet overflow occur return immediately. */
if (psize + offset > max_len)
if (psize + offset > max_len) {
*error = -1;
return offset;
}
/* Defensive coding, double-check
* the psize fits in a struct prefix
*/
if (psize > (ssize_t)sizeof(prefix_local.u))
if (psize > (ssize_t)sizeof(prefix_local.u)) {
*error = -1;
return offset;
}
memcpy(&prefix_local.u.prefix, &nlri_ptr[offset], psize);
offset += psize;
switch (type) {
@ -352,8 +359,10 @@ int bgp_flowspec_bitmask_decode(enum bgp_flowspec_util_nlri_t type,
*error = 0;
do {
if (loop > BGP_PBR_MATCH_VAL_MAX)
if (loop > BGP_PBR_MATCH_VAL_MAX) {
*error = -2;
return offset;
}
hex2bin(&nlri_ptr[offset], op);
/* if first element, AND bit can not be set */
if (op[1] == 1 && loop == 0)