From: David Watson <dwatson@eecs.umich.edu>

Subject: [zebra 18573] PATCH ospfd: byte order error in assert statement

 I found a bug in the ospfd code tickled this morning by a Type 1
 LSA with exactly 62 entries (LSA length of 768, or 0x0300).
 A missing ntohs in ospf_lsa.c:ospf_lsa_different() causes an assert
 statement to fail, stopping ospfd.
 >   assert (l1->data->length > OSPF_LSA_HEADER_SIZE);
 So, a length of type 768 turns into a length of 3 which is
 obviously less than 20.
 David

diff --git a/ospfd/ospf_lsa.c b/ospfd/ospf_lsa.c
index e01dbd0d0283d634cd4e086d7f733ef873d53b05..45b554fb052258e608daef2ca3310aa3123de797 100644 (file)
--- a/ospfd/ospf_lsa.c
+++ b/ospfd/ospf_lsa.c
@@ -2839,7 +2839,7 @@ ospf_lsa_different (struct ospf_lsa *l1, struct ospf_lsa *l2)
   if (l1->data->length ==  0)
     return 1;
 
-  assert (l1->data->length > OSPF_LSA_HEADER_SIZE);
+  assert ( ntohs(l1->data->length) > OSPF_LSA_HEADER_SIZE);
 
   p1 = (char *) l1->data;
   p2 = (char *) l2->data;