bgpd: Make sure hdr length is at a minimum of what is expected

Ensure that if the capability length specified is enough data.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit ff6db1027f8f36df657ff2e5ea167773752537ed)

diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
index 7613ccc7dfc5067ceeb980f80003f15a9ea94b5d..a5f065a15c8ba405eb0975be2a3f1c7537295a3e 100644 (file)
--- a/bgpd/bgp_packet.c
+++ b/bgpd/bgp_packet.c
@@ -2621,6 +2621,14 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
                                "%s CAPABILITY has action: %d, code: %u, length %u",
                                peer->host, action, hdr->code, hdr->length);
 
+               if (hdr->length < sizeof(struct capability_mp_data)) {
+                       zlog_info(
+                               "%pBP Capability structure is not properly filled out, expected at least %zu bytes but header length specified is %d",
+                               peer, sizeof(struct capability_mp_data),
+                               hdr->length);
+                       return BGP_Stop;
+               }
+
                /* Capability length check. */
                if ((pnt + hdr->length + 3) > end) {
                        zlog_info("%s Capability length error", peer->host);