diff options
| author | Iggy Frankovic <iggy07@gmail.com> | 2024-05-30 07:59:54 -0400 |
|---|---|---|
| committer | Mergify <37929162+mergify[bot]@users.noreply.github.com> | 2024-05-31 15:10:37 +0000 |
| commit | 359892fada32f43e5c20207000dd9330334b6a9c (patch) | |
| tree | 38a23409d22416d263a808df83de93765bf4adbe | |
| parent | d3aead43ef008c4cea0016a7975c733d68edb758 (diff) | |
ospf6d: Prevent heap-buffer-overflow with unknown type
When parsing a osf6 grace lsa field and we receive an
unknown tlv type, ospf6d was not incrementing the pointer
to get beyond the tlv. Leaving a situation where ospf6d
would parse the packet incorrectly.
Signed-off-by: Iggy Frankovic <iggy07@gmail.com>
(cherry picked from commit 826f2510e67711045e52cf4b5e3ddef514ed556e)
| -rw-r--r-- | ospf6d/ospf6_gr_helper.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/ospf6d/ospf6_gr_helper.c b/ospf6d/ospf6_gr_helper.c index be1042f260..42ea04833c 100644 --- a/ospf6d/ospf6_gr_helper.c +++ b/ospf6d/ospf6_gr_helper.c @@ -176,6 +176,7 @@ static int ospf6_extract_grace_lsa_fields(struct ospf6_lsa *lsa, return OSPF6_FAILURE; break; default: + sum += TLV_SIZE(tlvh); if (IS_DEBUG_OSPF6_GR) zlog_debug("%s, Ignoring unknown TLV type:%d", __func__, ntohs(tlvh->type)); |