]> git.puffer.fish Git - mirror/frr.git/commit
ospfd: protect call to get_edge() in ospf_te.c 16086/head
authorOlivier Dugeon <olivier.dugeon@orange.com>
Tue, 16 Apr 2024 14:42:06 +0000 (16:42 +0200)
committerMergify <37929162+mergify[bot]@users.noreply.github.com>
Fri, 24 May 2024 19:32:29 +0000 (19:32 +0000)
commit6520a6f4d1abbeca253b11a4fbbe2662e917ca69
tree16a43a28530cd7ff0c66b3caf9806d5217214d65
parentaa1237612cb26f38ccda1eb7725aedd46524d221
ospfd: protect call to get_edge() in ospf_te.c

During fuzzing, Iggy Frankovic discovered that get_edge() function in ospf_te.c
could return null pointer, in particular when the link_id or advertised router
IP addresses are fuzzed. As the null pointer returned by get_edge() function is
not handlei by calling functions, this could cause ospfd crash.

This patch introduces new verification of returned pointer by get_edge()
function and stop the processing in case of null pointer. In addition, link ID
and advertiser router ID are validated before calling ls_find_edge_by_key() to
avoid the creation of a new edge with an invalid key.

CVE-2024-34088

Co-authored-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
(cherry picked from commit 8c177d69e32b91b45bda5fc5da6511fa03dc11ca)
ospfd/ospf_te.c