diff options
Diffstat (limited to 'ospf6d/ospf6_gr_helper.c')
| -rw-r--r-- | ospf6d/ospf6_gr_helper.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/ospf6d/ospf6_gr_helper.c b/ospf6d/ospf6_gr_helper.c index 493dc6f093..33a7a57c0f 100644 --- a/ospf6d/ospf6_gr_helper.c +++ b/ospf6d/ospf6_gr_helper.c @@ -154,6 +154,12 @@ static int ospf6_extract_grace_lsa_fields(struct ospf6_lsa *lsa, int sum = 0; lsah = (struct ospf6_lsa_header *)lsa->header; + if (ntohs(lsah->length) <= OSPF6_LSA_HEADER_SIZE) { + if (IS_DEBUG_OSPF6_GR) + zlog_debug("%s: undersized (%u B) lsa", __func__, + ntohs(lsah->length)); + return OSPF6_FAILURE; + } length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE; @@ -394,8 +400,7 @@ int ospf6_process_grace_lsa(struct ospf6 *ospf6, struct ospf6_lsa *lsa, } if (OSPF6_GR_IS_ACTIVE_HELPER(restarter)) { - if (restarter->gr_helper_info.t_grace_timer) - THREAD_OFF(restarter->gr_helper_info.t_grace_timer); + THREAD_OFF(restarter->gr_helper_info.t_grace_timer); if (ospf6->ospf6_helper_cfg.active_restarter_cnt > 0) ospf6->ospf6_helper_cfg.active_restarter_cnt--; @@ -1245,6 +1250,12 @@ static int ospf6_grace_lsa_show_info(struct vty *vty, struct ospf6_lsa *lsa, int sum = 0; lsah = (struct ospf6_lsa_header *)lsa->header; + if (ntohs(lsah->length) <= OSPF6_LSA_HEADER_SIZE) { + if (IS_DEBUG_OSPF6_GR) + zlog_debug("%s: undersized (%u B) lsa", __func__, + ntohs(lsah->length)); + return OSPF6_FAILURE; + } length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE; |