]> git.puffer.fish Git - mirror/frr.git/commit
ospfd: Solved crash in RI parsing with OSPF TE
authorOlivier Dugeon <olivier.dugeon@orange.com>
Wed, 3 Apr 2024 14:28:23 +0000 (16:28 +0200)
committerOlivier Dugeon <olivier.dugeon@orange.com>
Thu, 23 May 2024 08:46:10 +0000 (10:46 +0200)
commitf69d1313b19047d3d83fc2b36a518355b861dfc4
tree6b2f2bc9171a70f869292cda03001d24aaa45f51
parente08495a4a8ad4d2050691d9e5e13662d2635b2e0
ospfd: Solved crash in RI parsing with OSPF TE

Iggy Frankovic discovered another ospfd crash when performing fuzzing of OSPF
LSA packets. The crash occurs in ospf_te_parse_ri() function when attemping to
read Segment Routing subTLVs. The original code doesn't check if the size of
the SR subTLVs have the correct length. In presence of erronous LSA, this will
cause a buffer overflow and ospfd crash.

This patch introduces new verification of the subTLVs size for Router
Information TLV.

Co-authored-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
ospfd/ospf_te.c