]> git.puffer.fish Git - mirror/frr.git/commit
ospfd: protect call to get_edge() in ospf_te.c 15674/head
authorOlivier Dugeon <olivier.dugeon@orange.com>
Tue, 16 Apr 2024 14:42:06 +0000 (16:42 +0200)
committerOlivier Dugeon <olivier.dugeon@orange.com>
Thu, 23 May 2024 08:47:34 +0000 (10:47 +0200)
commit8c177d69e32b91b45bda5fc5da6511fa03dc11ca
tree4f4afa07089d1dad30ceb5d09ff3fa7226e08fd5
parent5557a289acdaeec8cc63ffc97b5c2abf6dee7b3a
ospfd: protect call to get_edge() in ospf_te.c

During fuzzing, Iggy Frankovic discovered that get_edge() function in ospf_te.c
could return null pointer, in particular when the link_id or advertised router
IP addresses are fuzzed. As the null pointer returned by get_edge() function is
not handlei by calling functions, this could cause ospfd crash.

This patch introduces new verification of returned pointer by get_edge()
function and stop the processing in case of null pointer. In addition, link ID
and advertiser router ID are validated before calling ls_find_edge_by_key() to
avoid the creation of a new edge with an invalid key.

CVE-2024-34088

Co-authored-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
ospfd/ospf_te.c