From: Donald Sharp <sharpd@nvidia.com>
Date: Tue, 10 Oct 2023 17:31:13 +0000 (-0400)
Subject: Revert "bgpd: fix insecure data write with ip addresses"
X-Git-Tag: frr-9.1-rc~15^2~23
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=8ed3bbd19dd03bb9fdcb82e4784f004faa9af868;p=matthieu%2Ffrr.git

Revert "bgpd: fix insecure data write with ip addresses"

This reverts commit 54222f921305edbce74e81996e9303c0c6b03823.

(cherry picked from commit 298d53401344d2832bf462d143d0c32057f13139)
---

diff --git a/bgpd/bgp_linkstate_tlv.c b/bgpd/bgp_linkstate_tlv.c
index 48a570398e..97a024d7cd 100644
--- a/bgpd/bgp_linkstate_tlv.c
+++ b/bgpd/bgp_linkstate_tlv.c
@@ -577,8 +577,7 @@ static bool bgp_linkstate_nlri_value_display(char *buf, size_t size,
 		break;
 	case BGP_LS_TLV_IP_REACHABILITY_INFORMATION:
 		mask_length = pnt_decode8(&pnt);
-		if (nlri_type == BGP_LINKSTATE_PREFIX4 &&
-		    ((length - sizeof(mask_length)) <= sizeof(ipv4.s_addr))) {
+		if (nlri_type == BGP_LINKSTATE_PREFIX4) {
 			memcpy(&ipv4.s_addr, pnt, length - sizeof(mask_length));
 			if (json)
 				json_object_string_addf(json, "ipReachability",
@@ -588,8 +587,7 @@ static bool bgp_linkstate_nlri_value_display(char *buf, size_t size,
 				snprintfrr(buf, size, "%sIPv4:%pI4/%u",
 					   first ? "" : " ", &ipv4,
 					   mask_length);
-		} else if (nlri_type == BGP_LINKSTATE_PREFIX6 &&
-			   ((length - sizeof(mask_length)) <= sizeof(ipv6))) {
+		} else if (nlri_type == BGP_LINKSTATE_PREFIX6) {
 			memcpy(&ipv6, pnt, length - sizeof(mask_length));
 			if (json)
 				json_object_string_addf(json, "ipReachability",