]> git.puffer.fish Git - matthieu/frr.git/commit
ospfd: protect call to get_edge() in ospf_te.c
authorOlivier Dugeon <olivier.dugeon@orange.com>
Tue, 16 Apr 2024 14:42:06 +0000 (16:42 +0200)
committerMergify <37929162+mergify[bot]@users.noreply.github.com>
Fri, 24 May 2024 19:32:19 +0000 (19:32 +0000)
commit4b753fd134773962773210812d0afd07061a8183
tree013df12f7738a2cb93132f9b56fc19b78448c4e7
parentfc77daa322580961f2f18afb4747e9f33a36cb67
ospfd: protect call to get_edge() in ospf_te.c

During fuzzing, Iggy Frankovic discovered that get_edge() function in ospf_te.c
could return null pointer, in particular when the link_id or advertised router
IP addresses are fuzzed. As the null pointer returned by get_edge() function is
not handlei by calling functions, this could cause ospfd crash.

This patch introduces new verification of returned pointer by get_edge()
function and stop the processing in case of null pointer. In addition, link ID
and advertiser router ID are validated before calling ls_find_edge_by_key() to
avoid the creation of a new edge with an invalid key.

CVE-2024-34088

Co-authored-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
(cherry picked from commit 8c177d69e32b91b45bda5fc5da6511fa03dc11ca)
ospfd/ospf_te.c