diff options
| author | Jafar Al-Gharaibeh <Jafaral@users.noreply.github.com> | 2020-10-13 13:26:47 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-10-13 13:26:47 -0500 |
| commit | db5e14186d418fe8bfb3e5afb6159ff426a9a86d (patch) | |
| tree | 5de498f2fbda24fd72757e303c8970a856986408 /ospfclient/ospf_apiclient.c | |
| parent | 30a276f3c144b3f1b2eba25d9b2bdc0a1cd6049a (diff) | |
| parent | d7b4f53a0f58ae6e447f59abf250413d60e3d423 (diff) | |
Merge pull request #7245 from donaldsharp/ospf_coverity
ospfclient: Provide some protection against blindly trusting input
Diffstat (limited to 'ospfclient/ospf_apiclient.c')
| -rw-r--r-- | ospfclient/ospf_apiclient.c | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/ospfclient/ospf_apiclient.c b/ospfclient/ospf_apiclient.c index da390e3c70..fb8ad3e60a 100644 --- a/ospfclient/ospf_apiclient.c +++ b/ospfclient/ospf_apiclient.c @@ -49,6 +49,7 @@ #include "ospfd/ospf_route.h" #include "ospfd/ospf_zebra.h" #include "ospfd/ospf_api.h" +#include "ospfd/ospf_errors.h" #include "ospf_apiclient.h" @@ -564,12 +565,19 @@ static void ospf_apiclient_handle_lsa_update(struct ospf_apiclient *oclient, { struct msg_lsa_change_notify *cn; struct lsa_header *lsa; - int lsalen; + uint16_t lsalen; cn = (struct msg_lsa_change_notify *)STREAM_DATA(msg->s); /* Extract LSA from message */ lsalen = ntohs(cn->data.length); + if (lsalen > OSPF_MAX_LSA_SIZE) { + flog_warn( + EC_OSPF_LARGE_LSA, + "%s: message received size: %d is greater than a LSA size: %d", + __func__, lsalen, OSPF_MAX_LSA_SIZE); + return; + } lsa = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); memcpy(lsa, &(cn->data), lsalen); @@ -589,12 +597,19 @@ static void ospf_apiclient_handle_lsa_delete(struct ospf_apiclient *oclient, { struct msg_lsa_change_notify *cn; struct lsa_header *lsa; - int lsalen; + uint16_t lsalen; cn = (struct msg_lsa_change_notify *)STREAM_DATA(msg->s); /* Extract LSA from message */ lsalen = ntohs(cn->data.length); + if (lsalen > OSPF_MAX_LSA_SIZE) { + flog_warn( + EC_OSPF_LARGE_LSA, + "%s: message received size: %d is greater than a LSA size: %d", + __func__, lsalen, OSPF_MAX_LSA_SIZE); + return; + } lsa = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); memcpy(lsa, &(cn->data), lsalen); |