diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2017-10-09 16:36:52 -0400 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2017-10-09 19:29:09 -0400 |
| commit | 01b08f09c553b847ff740590eef6b2aedeafc952 (patch) | |
| tree | dfbba1fff06397f9998977072f151f4fed796a9a /babeld/babel_interface.h | |
| parent | f4dd8c46200b91fd589cb462739f3aca6b1a766f (diff) | |
babeld: Do not copy beyond end of data
The function really_send_update takes a 'const unsigned char *id'.
and is called with myid(a 8 byte array) and route->src->id(an 8
byte array), but we copy these pointers into
babel_ifp->buffered_id which is a 16 byte array.
Adjust the size of buffered_id to be 8 bytes and fix the copy
to only copy the 8 bytes.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'babeld/babel_interface.h')
| -rw-r--r-- | babeld/babel_interface.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/babeld/babel_interface.h b/babeld/babel_interface.h index 64509afa17..501177e602 100644 --- a/babeld/babel_interface.h +++ b/babeld/babel_interface.h @@ -50,7 +50,7 @@ struct babel_interface { char have_buffered_id; char have_buffered_nh; char have_buffered_prefix; - unsigned char buffered_id[16]; + unsigned char buffered_id[8]; unsigned char buffered_nh[4]; unsigned char buffered_prefix[16]; unsigned char *sendbuf; |