diff options
| author | Quentin Young <qlyoung@cumulusnetworks.com> | 2019-02-11 16:36:09 +0000 |
|---|---|---|
| committer | Quentin Young <qlyoung@cumulusnetworks.com> | 2019-05-17 00:27:08 +0000 |
| commit | 3d55d46721183994a5cbabe049b890a55c8dfef0 (patch) | |
| tree | ff7a1412ed04ef50f247ae645ccee3689255e6d5 /vrrpd/vrrp_packet.c | |
| parent | bb95fd82bcda3fc00696c1c990a3b2d539b67339 (diff) | |
vrrpd: allow creation of adverts with no addresses
Fuzz testing revealed a crash in which VRRPD tries to create an
advertisement packet with no IP addresses. Should never occur under
normal use but might as well patch.
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
Diffstat (limited to 'vrrpd/vrrp_packet.c')
| -rw-r--r-- | vrrpd/vrrp_packet.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/vrrpd/vrrp_packet.c b/vrrpd/vrrp_packet.c index 903bb3ae6c..7dcb2933f8 100644 --- a/vrrpd/vrrp_packet.c +++ b/vrrpd/vrrp_packet.c @@ -107,12 +107,17 @@ ssize_t vrrp_pkt_adver_build(struct vrrp_pkt **pkt, struct ipaddr *src, uint16_t max_adver_int, uint8_t numip, struct ipaddr **ips) { - bool v6 = IS_IPADDR_V6(ips[0]); + bool v6 = false; + size_t addrsz = 0; assert(version >= 2 && version <= 3); assert(!(version == 2 && v6)); - size_t addrsz = IPADDRSZ(ips[0]); + if (numip > 0) { + v6 = IS_IPADDR_V6(ips[0]); + addrsz = IPADDRSZ(ips[0]); + } + size_t pktsize = VRRP_PKT_SIZE(v6 ? AF_INET6 : AF_INET, numip); *pkt = XCALLOC(MTYPE_VRRP_PKT, pktsize); |