From b8fc83df96b3c6072a1cda4f3eb1ee49b9dee440 Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Wed, 20 Jul 2022 16:43:17 -0400 Subject: [PATCH] ospfclient: Ensure ospf_apiclient_lsa_originate cannot accidently write into stack Even though OSPF_MAX_LSA_SIZE is quite large and holds the upper bound on what can be written into a lsa, let's add a small check to ensure it is not possible to do a bad thing. This wins one of the long standing bug awards. 2003! Fixes: #11602 Signed-off-by: Donald Sharp (cherry picked from commit d2aeac38708d93fb028d6a53e6eea317f0c06d1b) --- ospfclient/ospf_apiclient.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ospfclient/ospf_apiclient.c b/ospfclient/ospf_apiclient.c index e84c6f5b3c..41f0b25b91 100644 --- a/ospfclient/ospf_apiclient.c +++ b/ospfclient/ospf_apiclient.c @@ -447,6 +447,12 @@ int ospf_apiclient_lsa_originate(struct ospf_apiclient *oclient, return OSPF_API_ILLEGALLSATYPE; } + if ((size_t)opaquelen > sizeof(buf) - sizeof(struct lsa_header)) { + fprintf(stderr, "opaquelen(%d) is larger than buf size %zu\n", + opaquelen, sizeof(buf)); + return OSPF_API_NOMEMORY; + } + /* Make a new LSA from parameters */ lsah = (struct lsa_header *)buf; lsah->ls_age = 0; -- 2.39.5