diff options
| author | Sri Mohana Singamsetty <srimohans@gmail.com> | 2019-11-19 10:31:47 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-11-19 10:31:47 -0800 |
| commit | 49fa8e917dffa9d65969317bbd11c8689aaa2e42 (patch) | |
| tree | 5546b47cca4372f98cc9a70ca578e89325aedefe /pimd/pim_pim.c | |
| parent | abdd51c11f2b34da053a655dd45ed17586b99d27 (diff) | |
| parent | 06424db44751bc646bcfa161403c82be0fe39e65 (diff) | |
Merge pull request #5375 from donaldsharp/pim_packet_issues
pimd: Fix possible read beyond end of data received
Diffstat (limited to 'pimd/pim_pim.c')
| -rw-r--r-- | pimd/pim_pim.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/pimd/pim_pim.c b/pimd/pim_pim.c index cd2d306f3d..342c0a74e0 100644 --- a/pimd/pim_pim.c +++ b/pimd/pim_pim.c @@ -190,6 +190,12 @@ int pim_pim_packet(struct interface *ifp, uint8_t *buf, size_t len) no_fwd = header->Nbit; if (header->type == PIM_MSG_TYPE_REGISTER) { + if (pim_msg_len < PIM_MSG_REGISTER_LEN) { + if (PIM_DEBUG_PIM_PACKETS) + zlog_debug("PIM Register Message size=%d shorther than min length %d", + pim_msg_len, PIM_MSG_REGISTER_LEN); + return -1; + } /* First 8 byte header checksum */ checksum = in_cksum(pim_msg, PIM_MSG_REGISTER_LEN); if (checksum != pim_checksum) { |