diff options
| author | paco <paco@voltanet.io> | 2018-06-15 12:57:47 +0200 |
|---|---|---|
| committer | paco <paco@voltanet.io> | 2018-06-15 14:46:25 +0200 |
| commit | 18e994a0437cfba9f4c09bd62293e13e49ea774b (patch) | |
| tree | f24d531f2e30ca7ae6a859936177b96cd9c420f5 | |
| parent | Merge pull request #2426 from pacovn/Coverity_23089_Buffer_not_null_terminated (diff) | |
| download | frr-18e994a0437cfba9f4c09bd62293e13e49ea774b.tar.xz frr-18e994a0437cfba9f4c09bd62293e13e49ea774b.zip | |
pimd: Untrusted val as argument (Coverity 1465491)
Signed-off-by: F. Aragon <paco@voltanet.io>
| -rw-r--r-- | pimd/mtracebis.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/pimd/mtracebis.c b/pimd/mtracebis.c index a073fa70b..731fdb1be 100644 --- a/pimd/mtracebis.c +++ b/pimd/mtracebis.c @@ -296,6 +296,10 @@ static int recv_response(int fd, int *hops, struct igmp_mtrace *mtracer) mtrace_len = ntohs(ip->ip_len) - ip->ip_hl * 4; + if ((char *)mtrace + mtrace_len + > (char *)mtrace_buf + IP_AND_MTRACE_BUF_LEN) + return -1; + if (mtrace_len < (int)MTRACE_HDR_SIZE) return -1; |