From f2e8b73572bb4b10adeeec5de8e9773f55749140 Mon Sep 17 00:00:00 2001 From: Renato Westphal Date: Wed, 13 Nov 2019 21:51:06 -0300 Subject: [PATCH] ldpd: add missing sanity check in the parsing of label messages Validate that the FEC prefix length is within the allowed limit (depending on the FEC address family) in order to prevent possible buffer overflows. Signed-off-by: Renato Westphal --- ldpd/labelmapping.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ldpd/labelmapping.c b/ldpd/labelmapping.c index 5e1b422a41..a656626356 100644 --- a/ldpd/labelmapping.c +++ b/ldpd/labelmapping.c @@ -723,6 +723,14 @@ tlv_decode_fec_elm(struct nbr *nbr, struct ldp_msg *msg, char *buf, /* Prefix Length */ map->fec.prefix.prefixlen = buf[off]; off += sizeof(uint8_t); + if ((map->fec.prefix.af == AF_IPV4 + && map->fec.prefix.prefixlen > IPV4_MAX_PREFIXLEN) + || (map->fec.prefix.af == AF_IPV6 + && map->fec.prefix.prefixlen > IPV6_MAX_PREFIXLEN)) { + session_shutdown(nbr, S_BAD_TLV_VAL, msg->id, + msg->type); + return (-1); + } if (len < off + PREFIX_SIZE(map->fec.prefix.prefixlen)) { session_shutdown(nbr, S_BAD_TLV_LEN, msg->id, msg->type);