From: anlan_cs Date: Wed, 19 Jan 2022 01:24:01 +0000 (-0500) Subject: ospf6d: add header size check for LSA X-Git-Tag: base_8.3~79^2 X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=905b12b2638bb5a99b7e4e43d9b237d3b63ece86;p=mirror%2Ffrr.git ospf6d: add header size check for LSA Add header size check for safe. If the check fails, just jump out of current function. Signed-off-by: anlan_cs --- diff --git a/ospf6d/ospf6_gr_helper.c b/ospf6d/ospf6_gr_helper.c index 493dc6f093..1db56beaff 100644 --- a/ospf6d/ospf6_gr_helper.c +++ b/ospf6d/ospf6_gr_helper.c @@ -154,6 +154,12 @@ static int ospf6_extract_grace_lsa_fields(struct ospf6_lsa *lsa, int sum = 0; lsah = (struct ospf6_lsa_header *)lsa->header; + if (ntohs(lsah->length) <= OSPF6_LSA_HEADER_SIZE) { + if (IS_DEBUG_OSPF6_GR) + zlog_debug("%s: undersized (%u B) lsa", __func__, + ntohs(lsah->length)); + return OSPF6_FAILURE; + } length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE; @@ -1245,6 +1251,12 @@ static int ospf6_grace_lsa_show_info(struct vty *vty, struct ospf6_lsa *lsa, int sum = 0; lsah = (struct ospf6_lsa_header *)lsa->header; + if (ntohs(lsah->length) <= OSPF6_LSA_HEADER_SIZE) { + if (IS_DEBUG_OSPF6_GR) + zlog_debug("%s: undersized (%u B) lsa", __func__, + ntohs(lsah->length)); + return OSPF6_FAILURE; + } length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE;