diff options
| author | Acee Lindem <acee@lindem.com> | 2024-09-18 18:09:19 +0000 |
|---|---|---|
| committer | Mergify <37929162+mergify[bot]@users.noreply.github.com> | 2024-09-18 23:57:58 +0000 |
| commit | 9ed1e92e1be41c2f3352278250a6f79dd9134890 (patch) | |
| tree | 5f32b5e5c278dffb472e4cbb0535ad076be65068 | |
| parent | cd82888fe82c54c2596dc8dd1495fc5c21c86631 (diff) | |
ospfd: Fix heap corruption vulnerability when parsing SR-Algorithm TLV
When parsing the SR-Algorithm TLV in the OSPF Router Information Opaque
LSA, assure that not more than the maximum number of supported
algorithms are copied from the TLV.
Signed-off-by: Acee Lindem <acee@lindem.com>
(cherry picked from commit 0dc969185fdd75fd007c9b29e11be57a078236df)
| -rw-r--r-- | ospfd/ospf_sr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ospfd/ospf_sr.c b/ospfd/ospf_sr.c index e26fe6f53a..db7e4180f5 100644 --- a/ospfd/ospf_sr.c +++ b/ospfd/ospf_sr.c @@ -1459,7 +1459,8 @@ void ospf_sr_ri_lsa_update(struct ospf_lsa *lsa) /* Update Algorithm, SRLB and MSD if present */ if (algo != NULL) { int i; - for (i = 0; i < ntohs(algo->header.length); i++) + for (i = 0; + i < ntohs(algo->header.length) && i < ALGORITHM_COUNT; i++) srn->algo[i] = algo->value[0]; for (; i < ALGORITHM_COUNT; i++) srn->algo[i] = SR_ALGORITHM_UNSET; |