diff options
| author | Quentin Young <qlyoung@nvidia.com> | 2020-09-02 22:44:13 +0200 |
|---|---|---|
| committer | Quentin Young <qlyoung@nvidia.com> | 2020-09-03 20:23:57 +0200 |
| commit | 763a5d3c2dc7e9061006d56a9a983c2a8be64765 (patch) | |
| tree | 04fffe5116f30f23f712d2d9f4859e2d384d0dae /bgpd | |
| parent | lib: add stream_rewind_getp() (diff) | |
| download | frr-763a5d3c2dc7e9061006d56a9a983c2a8be64765.tar.xz frr-763a5d3c2dc7e9061006d56a9a983c2a8be64765.zip | |
bgpd: use stream_rewind_getp() to remove overflow
Passing a negative argument to a size_t parameter creates an overflow
condition
Signed-off-by: Quentin Young <qlyoung@nvidia.com>
Diffstat (limited to 'bgpd')
| -rw-r--r-- | bgpd/bgp_attr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index cac3ab1ca..7c4ee44bd 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -3023,7 +3023,7 @@ bgp_attr_parse_ret_t bgp_attr_parse(struct peer *peer, struct attr *attr, size_t lfl = CHECK_FLAG(flag, BGP_ATTR_FLAG_EXTLEN) ? 2 : 1; /* Rewind to end of flag field */ - stream_forward_getp(BGP_INPUT(peer), -(1 + lfl)); + stream_rewind_getp(BGP_INPUT(peer), (1 + lfl)); /* Type */ stream_get(&ndata[0], BGP_INPUT(peer), 1); /* Length */ |