From 761ed6652411fc127e1eacb82144f158b3042a72 Mon Sep 17 00:00:00 2001 From: Quentin Young Date: Sun, 24 Nov 2019 02:02:54 -0500 Subject: [PATCH] bgpd: fix bad bounds check for addpath in nlri If a peer advertised capability addpath in their OPEN, but sent us an UPDATE without an ADDPATH, we overflow a heap buffer. Signed-off-by: Quentin Young --- bgpd/bgp_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c index fb2eb10dd9..71411df6ea 100644 --- a/bgpd/bgp_route.c +++ b/bgpd/bgp_route.c @@ -4481,7 +4481,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr, if (addpath_encoded) { /* When packet overflow occurs return immediately. */ - if (pnt + BGP_ADDPATH_ID_LEN > lim) + if (pnt + BGP_ADDPATH_ID_LEN >= lim) return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW; addpath_id = ntohl(*((uint32_t *)pnt)); -- 2.39.5