diff options
| author | qingkaishi <qingkaishi@gmail.com> | 2022-02-04 22:41:11 +0100 |
|---|---|---|
| committer | qingkaishi <qingkaishi@gmail.com> | 2022-02-04 22:58:56 +0100 |
| commit | c3793352a8d76d2eee1edc38a9a16c1c8a6573f4 (patch) | |
| tree | e445576b694a9cb7d840a0352319230b64b9de87 | |
| parent | Merge pull request #10501 from donaldsharp/more_zebra_show (diff) | |
| download | frr-c3793352a8d76d2eee1edc38a9a16c1c8a6573f4.tar.xz frr-c3793352a8d76d2eee1edc38a9a16c1c8a6573f4.zip | |
babeld: fix #10502 #10503 by repairing the checks on length
This patch repairs the checking conditions on length in four functions:
babel_packet_examin, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv
Signed-off-by: qingkaishi <qingkaishi@gmail.com>
| -rw-r--r-- | babeld/message.c | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/babeld/message.c b/babeld/message.c index 5c2e29d8b..053538700 100644 --- a/babeld/message.c +++ b/babeld/message.c @@ -140,12 +140,12 @@ parse_update_subtlv(const unsigned char *a, int alen, continue; } - if(i + 1 > alen) { + if(i + 1 >= alen) { flog_err(EC_BABEL_PACKET, "Received truncated attributes."); return; } len = a[i + 1]; - if(i + len > alen) { + if(i + len + 2 > alen) { flog_err(EC_BABEL_PACKET, "Received truncated attributes."); return; } @@ -182,19 +182,19 @@ parse_hello_subtlv(const unsigned char *a, int alen, int type, len, i = 0, ret = 0; while(i < alen) { - type = a[0]; + type = a[i]; if(type == SUBTLV_PAD1) { i++; continue; } - if(i + 1 > alen) { + if(i + 1 >= alen) { flog_err(EC_BABEL_PACKET, "Received truncated sub-TLV on Hello message."); return -1; } len = a[i + 1]; - if(i + len > alen) { + if(i + len + 2 > alen) { flog_err(EC_BABEL_PACKET, "Received truncated sub-TLV on Hello message."); return -1; @@ -228,19 +228,19 @@ parse_ihu_subtlv(const unsigned char *a, int alen, int type, len, i = 0, ret = 0; while(i < alen) { - type = a[0]; + type = a[i]; if(type == SUBTLV_PAD1) { i++; continue; } - if(i + 1 > alen) { + if(i + 1 >= alen) { flog_err(EC_BABEL_PACKET, "Received truncated sub-TLV on IHU message."); return -1; } len = a[i + 1]; - if(i + len > alen) { + if(i + len + 2 > alen) { flog_err(EC_BABEL_PACKET, "Received truncated sub-TLV on IHU message."); return -1; @@ -302,12 +302,12 @@ babel_packet_examin(const unsigned char *packet, int packetlen) i++; continue; } - if(i + 1 > bodylen) { + if(i + 2 > bodylen) { debugf(BABEL_DEBUG_COMMON,"Received truncated message."); return 1; } len = message[1]; - if(i + len > bodylen) { + if(i + len + 2 > bodylen) { debugf(BABEL_DEBUG_COMMON,"Received truncated message."); return 1; } |