proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-08 12:49:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ospf6d: Fix a possible deref by null found in SA

Browse Source 
There exists a possibility that rtr_lsa may be null.
Add an assert that shows we actually expect it to
be non-null at this point in time going forward.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
This commit is contained in:
Donald Sharp 2018-02-13 23:34:52 -05:00
parent d0a6f3e0c5
commit cf29dab3b5
1 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ospf6d/ospf6_spf.c
View File

@ -1029,19 +1029,22 @@ struct ospf6_lsa *ospf6_create_single_router_lsa(struct ospf6_area *area,
/* Fill Larger LSA Payload */ /* Fill Larger LSA Payload */
end = ospf6_lsdb_head(lsdb, 2, type, adv_router, &rtr_lsa); end = ospf6_lsdb_head(lsdb, 2, type, adv_router, &rtr_lsa);
if (rtr_lsa) {
/*
* We assume at this point in time that rtr_lsa is
* a valid pointer.
*/
assert(rtr_lsa);
if (!OSPF6_LSA_IS_MAXAGE(rtr_lsa)) { if (!OSPF6_LSA_IS_MAXAGE(rtr_lsa)) {
/* Append first Link State ID LSA */ /* Append first Link State ID LSA */
lsa_header = (struct ospf6_lsa_header *)rtr_lsa->header; lsa_header = (struct ospf6_lsa_header *)rtr_lsa->header;
memcpy(new_header, lsa_header, memcpy(new_header, lsa_header, ntohs(lsa_header->length));
ntohs(lsa_header->length));
/* Assign new lsa length as aggregated length. */ /* Assign new lsa length as aggregated length. */
((struct ospf6_lsa_header *)new_header)->length = ((struct ospf6_lsa_header *)new_header)->length =
htons(total_lsa_length); htons(total_lsa_length);
new_header += ntohs(lsa_header->length); new_header += ntohs(lsa_header->length);
num_lsa--; num_lsa--;
} }
}
/* Print LSA Name */ /* Print LSA Name */
ospf6_lsa_printbuf(lsa, lsa->name, sizeof(lsa->name)); ospf6_lsa_printbuf(lsa, lsa->name, sizeof(lsa->name));