From 14678bfa0d1c6cbf4346085676b1458461a0faaf Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Fri, 6 May 2022 21:24:56 -0400 Subject: [PATCH] isisd: Prevent direct copy of different size prefix'es Memory is allocated for a `struct prefix_ipv6` but it was directly copied into a `struct prefix` via direct pointer copy, which leads to a read past end of memory. Fix by using prefix_copy Signed-off-by: Donald Sharp --- isisd/isis_te.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/isisd/isis_te.c b/isisd/isis_te.c index 924922339c..579ae6aaba 100644 --- a/isisd/isis_te.c +++ b/isisd/isis_te.c @@ -909,7 +909,7 @@ static int lsp_to_subnet_cb(const struct prefix *prefix, uint32_t metric, p.u.prefix6 = std->local6; } if (!std) - p = *prefix; + prefix_copy(&p, prefix); else te_debug(" |- Adjust prefix %pFX with local address to: %pFX", prefix, &p); -- 2.39.5