diff options
| author | Olivier Dugeon <olivier.dugeon@orange.com> | 2024-04-16 16:42:06 +0200 |
|---|---|---|
| committer | Mergify <37929162+mergify[bot]@users.noreply.github.com> | 2024-05-24 19:32:19 +0000 |
| commit | 4b753fd134773962773210812d0afd07061a8183 (patch) | |
| tree | 013df12f7738a2cb93132f9b56fc19b78448c4e7 /pimd/pim_errors.c | |
| parent | fc77daa322580961f2f18afb4747e9f33a36cb67 (diff) | |
ospfd: protect call to get_edge() in ospf_te.c
During fuzzing, Iggy Frankovic discovered that get_edge() function in ospf_te.c
could return null pointer, in particular when the link_id or advertised router
IP addresses are fuzzed. As the null pointer returned by get_edge() function is
not handlei by calling functions, this could cause ospfd crash.
This patch introduces new verification of returned pointer by get_edge()
function and stop the processing in case of null pointer. In addition, link ID
and advertiser router ID are validated before calling ls_find_edge_by_key() to
avoid the creation of a new edge with an invalid key.
CVE-2024-34088
Co-authored-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
(cherry picked from commit 8c177d69e32b91b45bda5fc5da6511fa03dc11ca)
Diffstat (limited to 'pimd/pim_errors.c')
0 files changed, 0 insertions, 0 deletions