proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-07 09:22:03 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ospfd: fix uaf upon rx of self-originated lsa

Browse Source 
ospf_opaque_self_originated_lsa_received decrements refcount which can
result in a free, this is followed by a call to ospf_ls_ack_send which
accesses the freed LSA

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
This commit is contained in:
Quentin Young 2020-04-14 01:43:13 -04:00
parent 1b0f1cb4d7
commit f45be0e105
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ospfd/ospf_packet.c
View File

@ -2038,10 +2038,10 @@ static void ospf_ls_upd(struct ospf *ospf, struct ip *iph,
SET_FLAG(lsa->flags, OSPF_LSA_SELF); SET_FLAG(lsa->flags, OSPF_LSA_SELF);
ospf_opaque_self_originated_lsa_received(nbr,
lsa);
ospf_ls_ack_send(nbr, lsa); ospf_ls_ack_send(nbr, lsa);
ospf_opaque_self_originated_lsa_received(nbr,
lsa);
continue; continue;
} }
} }