From ff6566f3efaad50d09f0327953b57f75dc607de0 Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Tue, 5 Dec 2017 10:09:36 -0500 Subject: [PATCH] bgpd: Cleanup SA error in ignoring return from function Ignoring the return from argv_find_and_parse_afi makes the SA system assume that you could pass a AFI_MAX value to bgp_show_route. Which in turn would cause an array out of bounds read. Signed-off-by: Donald Sharp --- bgpd/bgp_route.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c index a655bd0b6f..8774e3e806 100644 --- a/bgpd/bgp_route.c +++ b/bgpd/bgp_route.c @@ -10569,12 +10569,17 @@ DEFUN (show_bgp_afi_vpn_rd_route, afi_t afi = AFI_MAX; int idx = 0; - (void)argv_find_and_parse_afi(argv, argc, &idx, &afi); + if (!argv_find_and_parse_afi(argv, argc, &idx, &afi)) { + vty_out(vty, "%% Malformed Address Family\n"); + return CMD_WARNING; + } + ret = str2prefix_rd(argv[5]->arg, &prd); if (!ret) { vty_out(vty, "%% Malformed Route Distinguisher\n"); return CMD_WARNING; } + return bgp_show_route(vty, NULL, argv[6]->arg, afi, SAFI_MPLS_VPN, &prd, 0, BGP_PATH_ALL, use_json(argc, argv)); }