mirror of
https://git.proxmox.com/git/mirror_frr
synced 2025-06-09 19:10:37 +00:00
Merge pull request #10528 from FRRouting/mergify/bp/dev/8.2/pr-10504
babeld: fix the checks for truncated packets (backport #10504)
This commit is contained in:
commit
c3a60e8854
@ -140,12 +140,12 @@ parse_update_subtlv(const unsigned char *a, int alen,
|
|||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
if(i + 1 > alen) {
|
if(i + 1 >= alen) {
|
||||||
flog_err(EC_BABEL_PACKET, "Received truncated attributes.");
|
flog_err(EC_BABEL_PACKET, "Received truncated attributes.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
len = a[i + 1];
|
len = a[i + 1];
|
||||||
if(i + len > alen) {
|
if(i + len + 2 > alen) {
|
||||||
flog_err(EC_BABEL_PACKET, "Received truncated attributes.");
|
flog_err(EC_BABEL_PACKET, "Received truncated attributes.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
@ -182,19 +182,19 @@ parse_hello_subtlv(const unsigned char *a, int alen,
|
|||||||
int type, len, i = 0, ret = 0;
|
int type, len, i = 0, ret = 0;
|
||||||
|
|
||||||
while(i < alen) {
|
while(i < alen) {
|
||||||
type = a[0];
|
type = a[i];
|
||||||
if(type == SUBTLV_PAD1) {
|
if(type == SUBTLV_PAD1) {
|
||||||
i++;
|
i++;
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
if(i + 1 > alen) {
|
if(i + 1 >= alen) {
|
||||||
flog_err(EC_BABEL_PACKET,
|
flog_err(EC_BABEL_PACKET,
|
||||||
"Received truncated sub-TLV on Hello message.");
|
"Received truncated sub-TLV on Hello message.");
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
len = a[i + 1];
|
len = a[i + 1];
|
||||||
if(i + len > alen) {
|
if(i + len + 2 > alen) {
|
||||||
flog_err(EC_BABEL_PACKET,
|
flog_err(EC_BABEL_PACKET,
|
||||||
"Received truncated sub-TLV on Hello message.");
|
"Received truncated sub-TLV on Hello message.");
|
||||||
return -1;
|
return -1;
|
||||||
@ -228,19 +228,19 @@ parse_ihu_subtlv(const unsigned char *a, int alen,
|
|||||||
int type, len, i = 0, ret = 0;
|
int type, len, i = 0, ret = 0;
|
||||||
|
|
||||||
while(i < alen) {
|
while(i < alen) {
|
||||||
type = a[0];
|
type = a[i];
|
||||||
if(type == SUBTLV_PAD1) {
|
if(type == SUBTLV_PAD1) {
|
||||||
i++;
|
i++;
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
if(i + 1 > alen) {
|
if(i + 1 >= alen) {
|
||||||
flog_err(EC_BABEL_PACKET,
|
flog_err(EC_BABEL_PACKET,
|
||||||
"Received truncated sub-TLV on IHU message.");
|
"Received truncated sub-TLV on IHU message.");
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
len = a[i + 1];
|
len = a[i + 1];
|
||||||
if(i + len > alen) {
|
if(i + len + 2 > alen) {
|
||||||
flog_err(EC_BABEL_PACKET,
|
flog_err(EC_BABEL_PACKET,
|
||||||
"Received truncated sub-TLV on IHU message.");
|
"Received truncated sub-TLV on IHU message.");
|
||||||
return -1;
|
return -1;
|
||||||
@ -302,12 +302,12 @@ babel_packet_examin(const unsigned char *packet, int packetlen)
|
|||||||
i++;
|
i++;
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
if(i + 1 > bodylen) {
|
if(i + 2 > bodylen) {
|
||||||
debugf(BABEL_DEBUG_COMMON,"Received truncated message.");
|
debugf(BABEL_DEBUG_COMMON,"Received truncated message.");
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
len = message[1];
|
len = message[1];
|
||||||
if(i + len > bodylen) {
|
if(i + len + 2 > bodylen) {
|
||||||
debugf(BABEL_DEBUG_COMMON,"Received truncated message.");
|
debugf(BABEL_DEBUG_COMMON,"Received truncated message.");
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user