From a73e66d07329d721f26f3f336f7735de420b0183 Mon Sep 17 00:00:00 2001 From: Olivier Dugeon Date: Mon, 26 Feb 2024 10:40:34 +0100 Subject: [PATCH] ospfd: Solved crash in OSPF TE parsing Iggy Frankovic discovered an ospfd crash when perfomring fuzzing of OSPF LSA packets. The crash occurs in ospf_te_parse_te() function when attemping to create corresponding egde from TE Link parameters. If there is no local address, an edge is created but without any attributes. During parsing, the function try to access to this attribute fields which has not been created causing an ospfd crash. The patch simply check if the te parser has found a valid local address. If not found, we stop the parser which avoid the crash. Signed-off-by: Olivier Dugeon --- ospfd/ospf_te.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c index a55a37a907..359dc1f5d4 100644 --- a/ospfd/ospf_te.c +++ b/ospfd/ospf_te.c @@ -2246,6 +2246,10 @@ static int ospf_te_parse_te(struct ls_ted *ted, struct ospf_lsa *lsa) } /* Get corresponding Edge from Link State Data Base */ + if (IPV4_NET0(attr.standard.local.s_addr) && !attr.standard.local_id) { + ote_debug(" |- Found no TE Link local address/ID. Abort!"); + return -1; + } edge = get_edge(ted, attr.adv, attr.standard.local); old = edge->attributes; -- 2.39.5