proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-13 22:26:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ospfd: Prevent crash by accessing memory not owned.

Browse Source 
When allocating memory for the `struct ospf_metric` we
were using `uint32_t` instead of the actual size of this
structure.  When we wrote to it we would be writing
into other people's memory.

Found-by: Amol Lad
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
This commit is contained in:
Donald Sharp 2020-11-25 09:49:28 -05:00
parent f286bcf5fc
commit cf0f13de29
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ospfd/ospf_routemap.c
View File

@ -416,7 +416,7 @@ static void *route_set_metric_compile(const char *arg)
{
struct ospf_metric *metric;
metric = XCALLOC(MTYPE_ROUTE_MAP_COMPILED, sizeof(uint32_t));
metric = XCALLOC(MTYPE_ROUTE_MAP_COMPILED, sizeof(*metric));
metric->used = false;
if (all_digit(arg))