proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-04-30 12:01:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #16785 from FRRouting/mergify/bp/stable/9.1/pr-16718

Browse Source 
isisd: fix crash when reading asla (backport #16718)
This commit is contained in:
Jafar Al-Gharaibeh 2024-09-11 00:01:30 -04:00 committed by GitHub
commit c709528028
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
isisd/isis_tlvs.c
View File

@ -1448,8 +1448,8 @@ static int unpack_item_ext_subtlv_asla(uint16_t mtid, uint8_t subtlv_len,
uint8_t sabm_flag_len; uint8_t sabm_flag_len;
/* User-defined App Identifier Bit Flags/Length */ /* User-defined App Identifier Bit Flags/Length */
uint8_t uabm_flag_len; uint8_t uabm_flag_len;
uint8_t sabm[ASLA_APP_IDENTIFIER_BIT_LENGTH] = {0}; uint8_t sabm[ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH] = { 0 };
uint8_t uabm[ASLA_APP_IDENTIFIER_BIT_LENGTH] = {0}; uint8_t uabm[ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH] = { 0 };
uint8_t readable = subtlv_len; uint8_t readable = subtlv_len;
uint8_t subsubtlv_type; uint8_t subsubtlv_type;
uint8_t subsubtlv_len; uint8_t subsubtlv_len;
@ -1480,6 +1480,15 @@ static int unpack_item_ext_subtlv_asla(uint16_t mtid, uint8_t subtlv_len,
return -1; return -1;
} }
if ((asla->standard_apps_length > ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH) ||
(asla->user_def_apps_length > ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH)) {
zlog_err("Standard or User-Defined Application Identifier Bit Mask Length greater than %u bytes. Received respectively a length of %u and %u bytes.",
ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH,
asla->standard_apps_length, asla->user_def_apps_length);
stream_forward_getp(s, readable);
return -1;
}
for (int i = 0; i < asla->standard_apps_length; i++) for (int i = 0; i < asla->standard_apps_length; i++)
sabm[i] = stream_getc(s); sabm[i] = stream_getc(s);
for (int i = 0; i < asla->user_def_apps_length; i++) for (int i = 0; i < asla->user_def_apps_length; i++)

1
isisd/isis_tlvs.h
View File

@ -717,6 +717,7 @@ struct isis_ext_subtlvs {
#define ISIS_SABM_FLAG_X 0x10 /* Flex-Algorithm - RFC9350 */ #define ISIS_SABM_FLAG_X 0x10 /* Flex-Algorithm - RFC9350 */
#define ASLA_APP_IDENTIFIER_BIT_LENGTH 1 #define ASLA_APP_IDENTIFIER_BIT_LENGTH 1
#define ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH 8
#define ASLA_LEGACY_FLAG 0x80 #define ASLA_LEGACY_FLAG 0x80
#define ASLA_APPS_LENGTH_MASK 0x7f #define ASLA_APPS_LENGTH_MASK 0x7f