diff options
| author | Donald Sharp <donaldsharp72@gmail.com> | 2024-06-06 08:20:53 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-06-06 08:20:53 -0400 |
| commit | e1e84a70a0a660069cf503182f834009997f1d24 (patch) | |
| tree | ca734cff680a4c06e5df79f2d692b08620924644 | |
| parent | 3962ec5338d2d92e495b38fa79a8eee7aad81110 (diff) | |
| parent | 28d2e126c7fea07de22e52201a70fbf0c94b5dc6 (diff) | |
Merge pull request #16171 from mjstapp/fix_fpm_nl_len_check
zebra: fix incoming FPM message length validation
| -rw-r--r-- | zebra/dplane_fpm_nl.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/zebra/dplane_fpm_nl.c b/zebra/dplane_fpm_nl.c index 245b799a91..9ad92d6269 100644 --- a/zebra/dplane_fpm_nl.c +++ b/zebra/dplane_fpm_nl.c @@ -654,14 +654,6 @@ static void fpm_read(struct event *t) hdr_available_bytes = fpm.msg_len - FPM_MSG_HDR_LEN; available_bytes -= hdr_available_bytes; - /* Sanity check: must be at least header size. */ - if (hdr->nlmsg_len < sizeof(*hdr)) { - zlog_warn( - "%s: [seq=%u] invalid message length %u (< %zu)", - __func__, hdr->nlmsg_seq, hdr->nlmsg_len, - sizeof(*hdr)); - continue; - } if (hdr->nlmsg_len > fpm.msg_len) { zlog_warn( "%s: Received a inner header length of %u that is greater than the fpm total length of %u", @@ -691,6 +683,14 @@ static void fpm_read(struct event *t) switch (hdr->nlmsg_type) { case RTM_NEWROUTE: + /* Sanity check: need at least route msg header size. */ + if (hdr->nlmsg_len < sizeof(struct rtmsg)) { + zlog_warn("%s: [seq=%u] invalid message length %u (< %zu)", + __func__, hdr->nlmsg_seq, + hdr->nlmsg_len, sizeof(struct rtmsg)); + break; + } + ctx = dplane_ctx_alloc(); dplane_ctx_route_init(ctx, DPLANE_OP_ROUTE_NOTIFY, NULL, NULL); |