diff options
| author | Satheesh Kumar K <sathk@cumulusnetworks.com> | 2019-10-10 21:33:19 -0700 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-03-06 16:03:59 -0500 |
| commit | 83f8a12b8ecbc3ffb285a59b6ce0a86e3a0cfb8f (patch) | |
| tree | 0d7f848ec54b3b866a7c8cb8c32b19d2155da241 /pimd/pim_mlag.c | |
| parent | fa696b37276b7c396e55aba1a55b0b7441af14e9 (diff) | |
lib, pimd, zebra: Provide some insurance against reading bad stream data
This patch does two things:
1) Ensure the decoding of stream data between pim <-> zebra is properly
decoded and we don't read beyond the end of the stream.
2) In zebra when we are freeing memory alloced ensure that we
actually have memory to delete before we do so.
Ticket: CM-27055
Signed-off-by: Satheesh Kumar K <sathk@cumulusnetworks.com>
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'pimd/pim_mlag.c')
| -rw-r--r-- | pimd/pim_mlag.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/pimd/pim_mlag.c b/pimd/pim_mlag.c index 321745590d..0a6ff41114 100644 --- a/pimd/pim_mlag.c +++ b/pimd/pim_mlag.c @@ -765,8 +765,9 @@ int pim_zebra_mlag_handle_msg(struct stream *s, int len) struct mlag_msg mlag_msg; char buf[ZLOG_FILTER_LENGTH_MAX]; int rc = 0; + size_t length; - rc = mlag_lib_decode_mlag_hdr(s, &mlag_msg); + rc = mlag_lib_decode_mlag_hdr(s, &mlag_msg, &length); if (rc) return (rc); @@ -805,7 +806,7 @@ int pim_zebra_mlag_handle_msg(struct stream *s, int len) case MLAG_MROUTE_ADD: { struct mlag_mroute_add msg; - rc = mlag_lib_decode_mroute_add(s, &msg); + rc = mlag_lib_decode_mroute_add(s, &msg, &length); if (rc) return (rc); pim_mlag_process_mroute_add(msg); @@ -813,7 +814,7 @@ int pim_zebra_mlag_handle_msg(struct stream *s, int len) case MLAG_MROUTE_DEL: { struct mlag_mroute_del msg; - rc = mlag_lib_decode_mroute_del(s, &msg); + rc = mlag_lib_decode_mroute_del(s, &msg, &length); if (rc) return (rc); pim_mlag_process_mroute_del(msg); @@ -823,8 +824,7 @@ int pim_zebra_mlag_handle_msg(struct stream *s, int len) int i; for (i = 0; i < mlag_msg.msg_cnt; i++) { - - rc = mlag_lib_decode_mroute_add(s, &msg); + rc = mlag_lib_decode_mroute_add(s, &msg, &length); if (rc) return (rc); pim_mlag_process_mroute_add(msg); @@ -835,8 +835,7 @@ int pim_zebra_mlag_handle_msg(struct stream *s, int len) int i; for (i = 0; i < mlag_msg.msg_cnt; i++) { - - rc = mlag_lib_decode_mroute_del(s, &msg); + rc = mlag_lib_decode_mroute_del(s, &msg, &length); if (rc) return (rc); pim_mlag_process_mroute_del(msg); |