From: Donald Sharp <sharpd@nvidia.com>
Date: Wed, 20 Jul 2022 20:43:17 +0000 (-0400)
Subject: ospfclient: Ensure ospf_apiclient_lsa_originate cannot accidently write into stack
X-Git-Tag: frr-8.3.2~14^2~2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=b8fc83df96b3c6072a1cda4f3eb1ee49b9dee440;p=matthieu%2Ffrr.git

ospfclient: Ensure ospf_apiclient_lsa_originate cannot accidently write into stack

Even though OSPF_MAX_LSA_SIZE is quite large and holds the upper bound
on what can be written into a lsa, let's add a small check to ensure
it is not possible to do a bad thing.

This wins one of the long standing bug awards.  2003!

Fixes: #11602
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit d2aeac38708d93fb028d6a53e6eea317f0c06d1b)
---

diff --git a/ospfclient/ospf_apiclient.c b/ospfclient/ospf_apiclient.c
index e84c6f5b3c..41f0b25b91 100644
--- a/ospfclient/ospf_apiclient.c
+++ b/ospfclient/ospf_apiclient.c
@@ -447,6 +447,12 @@ int ospf_apiclient_lsa_originate(struct ospf_apiclient *oclient,
 		return OSPF_API_ILLEGALLSATYPE;
 	}
 
+	if ((size_t)opaquelen > sizeof(buf) - sizeof(struct lsa_header)) {
+		fprintf(stderr, "opaquelen(%d) is larger than buf size %zu\n",
+			opaquelen, sizeof(buf));
+		return OSPF_API_NOMEMORY;
+	}
+
 	/* Make a new LSA from parameters */
 	lsah = (struct lsa_header *)buf;
 	lsah->ls_age = 0;