ospf6d: add header size check for LSA

Add header size check for safe. If the check fails, just jump out of current
function.

Signed-off-by: anlan_cs <vic.lan@pica8.com>

diff --git a/ospf6d/ospf6_gr_helper.c b/ospf6d/ospf6_gr_helper.c
index 493dc6f0938e6ae26b674d5616cd5713cac7d581..1db56beaff94f160ab6e56b70f3d437d7801e974 100644 (file)
--- a/ospf6d/ospf6_gr_helper.c
+++ b/ospf6d/ospf6_gr_helper.c
@@ -154,6 +154,12 @@ static int ospf6_extract_grace_lsa_fields(struct ospf6_lsa *lsa,
        int sum = 0;
 
        lsah = (struct ospf6_lsa_header *)lsa->header;
+       if (ntohs(lsah->length) <= OSPF6_LSA_HEADER_SIZE) {
+               if (IS_DEBUG_OSPF6_GR)
+                       zlog_debug("%s: undersized (%u B) lsa", __func__,
+                                  ntohs(lsah->length));
+               return OSPF6_FAILURE;
+       }
 
        length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE;
 
@@ -1245,6 +1251,12 @@ static int ospf6_grace_lsa_show_info(struct vty *vty, struct ospf6_lsa *lsa,
        int sum = 0;
 
        lsah = (struct ospf6_lsa_header *)lsa->header;
+       if (ntohs(lsah->length) <= OSPF6_LSA_HEADER_SIZE) {
+               if (IS_DEBUG_OSPF6_GR)
+                       zlog_debug("%s: undersized (%u B) lsa", __func__,
+                                  ntohs(lsah->length));
+               return OSPF6_FAILURE;
+       }
 
        length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE;