diff options
| author | Donald Sharp <donaldsharp72@gmail.com> | 2023-10-25 15:33:13 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-10-25 15:33:13 -0400 |
| commit | 010f8998d736f3420f6a6dd44af606b26dbe1108 (patch) | |
| tree | f3b67884fc4da63c6ff3f2f77e15b2a493010dbc /bgpd/bgp_attr.c | |
| parent | 42cae6e9bd5e779c4a62526cb744184e5fba8bb2 (diff) | |
| parent | 6cca03a52e047f1271807ac501b08b3a4f5ad344 (diff) | |
Merge pull request #14653 from FRRouting/mergify/bp/dev/9.1/pr-14645frr-9.1-rc
bgpd: A couple more bgpd crashes on malformed attributes (backport #14645)
Diffstat (limited to 'bgpd/bgp_attr.c')
| -rw-r--r-- | bgpd/bgp_attr.c | 16 |
1 files changed, 7 insertions, 9 deletions
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index 7916233444..bf33e8e3ec 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -2422,7 +2422,7 @@ int bgp_mp_reach_parse(struct bgp_attr_parser_args *args, mp_update->afi = afi; mp_update->safi = safi; - return BGP_ATTR_PARSE_EOR; + return bgp_attr_malformed(args, BGP_NOTIFY_UPDATE_MAL_ATTR, 0); } mp_update->afi = afi; @@ -3385,13 +3385,15 @@ bgp_attr_unknown(struct bgp_attr_parser_args *args) } /* Well-known attribute check. */ -static int bgp_attr_check(struct peer *peer, struct attr *attr) +static int bgp_attr_check(struct peer *peer, struct attr *attr, + bgp_size_t length) { uint8_t type = 0; /* BGP Graceful-Restart End-of-RIB for IPv4 unicast is signaled as an * empty UPDATE. */ - if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag) + if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag && + !length) return BGP_ATTR_PARSE_PROCEED; /* "An UPDATE message that contains the MP_UNREACH_NLRI is not required @@ -3443,7 +3445,7 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr, enum bgp_attr_parse_ret ret; uint8_t flag = 0; uint8_t type = 0; - bgp_size_t length; + bgp_size_t length = 0; uint8_t *startp, *endp; uint8_t *attr_endp; uint8_t seen[BGP_ATTR_BITMAP_SIZE]; @@ -3759,10 +3761,6 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr, goto done; } - if (ret == BGP_ATTR_PARSE_EOR) { - goto done; - } - if (ret == BGP_ATTR_PARSE_ERROR) { flog_warn(EC_BGP_ATTRIBUTE_PARSE_ERROR, "%s: Attribute %s, parse error", peer->host, @@ -3835,7 +3833,7 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr, } /* Check all mandatory well-known attributes are present */ - ret = bgp_attr_check(peer, attr); + ret = bgp_attr_check(peer, attr, length); if (ret < 0) goto done; |