mirror of
https://git.proxmox.com/git/mirror_frr
synced 2025-07-25 09:28:50 +00:00
c30420200b
vector_remove would corrupt the data in the following sequence: 1. assume vector v = [a, b], active = 2 2. vector_unset(v, 0) => v = [NULL, b], active = 2 3. vector_remove(v, 1) vector_remove calls vector_unset(v, 1), vector_unset notices index #0 is also NULL and thus sets active to 0. The equality test in vector_remove() now fails, leading it to decrement v->active *again*, leading to an underflow that will likely crash the daemon (and might even be exploitable). This call sequence does not happen in existing code since vector_unset() is not used on graph from/to lists. Nonetheless this is a buried land mine in the code at best. Rewrite the function - while we're at it, there's no reason to move the entire array around, just fill the hole with the last element. Signed-off-by: David Lamparter <equinox@opensourcerouting.org> Cc: Quentin Young <qlyoung@cumulusnetworks.com> |
||
|---|---|---|
| bgpd | ||
| cumulus | ||
| debian | ||
| doc | ||
| fpm | ||
| gdb | ||
| init | ||
| isisd | ||
| ldpd | ||
| lib | ||
| m4 | ||
| ospf6d | ||
| ospfclient | ||
| ospfd | ||
| pimd | ||
| pkgsrc | ||
| ports | ||
| qpb | ||
| redhat | ||
| ripd | ||
| ripngd | ||
| solaris | ||
| tests | ||
| tools | ||
| vtysh | ||
| watchfrr | ||
| zebra | ||
| .gitignore | ||
| AUTHORS | ||
| bootstrap.sh | ||
| buildtest.sh | ||
| ChangeLog | ||
| common.am | ||
| COMMUNITY.md | ||
| configure.ac | ||
| COPYING | ||
| COPYING-LGPLv2.1 | ||
| Makefile.am | ||
| NEWS | ||
| README | ||
| README.NetBSD | ||
| render_md.py | ||
| REPORTING-BUGS | ||
| SERVICES | ||
| stamp-h.in | ||
| update-autotools | ||
Free Range Routing is free software that manages various IPv4 and IPv6 routing protocols. Currently Free Range Routing supports BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, RIPng, PIM-SSM and LDP as well as very early support for IS-IS. See the file REPORTING-BUGS to report bugs. Free Range Routing is free software. See the file COPYING for copying conditions.