diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2019-11-19 08:22:50 -0500 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2019-11-19 08:22:50 -0500 |
| commit | 06424db44751bc646bcfa161403c82be0fe39e65 (patch) | |
| tree | dccb664de6e26694118c78727487f7ba8e2f0da6 /lib/command.h | |
| parent | 47774e275799ce2baf814c5ae00f1bfa001b5d4b (diff) | |
pimd: Fix possible read beyond end of data received
If a register packet is received that is less than the PIM_MSG_REGISTER_LEN
in size we can have a possible situation where the data being
checksummed is just random data from the buffer we read into.
2019/11/18 21:45:46 warnings: PIM: int pim_if_add_vif(struct interface *, _Bool, _Bool): could not get address for interface fuzziface ifindex=0
==27636== Invalid read of size 4
==27636== at 0x4E6EB0D: in_cksum (checksum.c:28)
==27636== by 0x4463CC: pim_pim_packet (pim_pim.c:194)
==27636== by 0x40E2B4: main (pim_main.c:117)
==27636== Address 0x771f818 is 0 bytes after a block of size 24 alloc'd
==27636== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==27636== by 0x40E261: main (pim_main.c:112)
==27636==
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'lib/command.h')
0 files changed, 0 insertions, 0 deletions
