From a74e593b3545374a9021f8264152dba42e08323a Mon Sep 17 00:00:00 2001 From: Renato Westphal Date: Thu, 21 Sep 2017 09:49:31 -0300 Subject: *: fix segfault when sending more than MULTIPATH_NUM nexthops This is a fallout from PR #1022 (zapi consolidation). In the early days, the client daemons would allocate enough memory to send all nexthops to zebra. Then zebra would add all nexthops to the RIB and respect MULTIPATH_NUM only when installing the routes in the kernel. Now things are different and the client daemons can send at most MULTIPATH_NUM nexthops to zebra, and failure to respect that will result in a buffer overflow. The MULTIPATH_NUM limit in the new zebra API is a small price we pay to avoid allocating memory for each route sent to zebra. Signed-off-by: Renato Westphal --- ospf6d/ospf6_zebra.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'ospf6d/ospf6_zebra.c') diff --git a/ospf6d/ospf6_zebra.c b/ospf6d/ospf6_zebra.c index 2372bc54b7..30bb4393c7 100644 --- a/ospf6d/ospf6_zebra.c +++ b/ospf6d/ospf6_zebra.c @@ -341,8 +341,8 @@ static void ospf6_zebra_route_update(int type, struct ospf6_route *request) api.safi = SAFI_UNICAST; api.prefix = *dest; SET_FLAG(api.message, ZAPI_MESSAGE_NEXTHOP); - api.nexthop_num = nhcount; - ospf6_route_zebra_copy_nexthops(request, api.nexthops, nhcount); + api.nexthop_num = MIN(nhcount, MULTIPATH_NUM); + ospf6_route_zebra_copy_nexthops(request, api.nexthops, api.nexthop_num); SET_FLAG(api.message, ZAPI_MESSAGE_METRIC); api.metric = (request->path.metric_type == 2 ? request->path.u.cost_e2 : request->path.cost); -- cgit v1.2.3