diff options
| author | Renato Westphal <renato@opensourcerouting.org> | 2017-09-21 14:49:31 +0200 |
|---|---|---|
| committer | Renato Westphal <renato@opensourcerouting.org> | 2017-09-21 16:21:09 +0200 |
| commit | a74e593b3545374a9021f8264152dba42e08323a (patch) | |
| tree | f4e3c701b0bbf97aa03d4cfc3bee2baddb639bad /eigrpd | |
| parent | Merge pull request #1212 from mkanjari/init-fix (diff) | |
| download | frr-a74e593b3545374a9021f8264152dba42e08323a.tar.xz frr-a74e593b3545374a9021f8264152dba42e08323a.zip | |
*: fix segfault when sending more than MULTIPATH_NUM nexthops
This is a fallout from PR #1022 (zapi consolidation). In the early days,
the client daemons would allocate enough memory to send all nexthops
to zebra. Then zebra would add all nexthops to the RIB and respect
MULTIPATH_NUM only when installing the routes in the kernel. Now things
are different and the client daemons can send at most MULTIPATH_NUM
nexthops to zebra, and failure to respect that will result in a buffer
overflow. The MULTIPATH_NUM limit in the new zebra API is a small price
we pay to avoid allocating memory for each route sent to zebra.
Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
Diffstat (limited to 'eigrpd')
| -rw-r--r-- | eigrpd/eigrp_zebra.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/eigrpd/eigrp_zebra.c b/eigrpd/eigrp_zebra.c index e61b3d748..95d97cf97 100644 --- a/eigrpd/eigrp_zebra.c +++ b/eigrpd/eigrp_zebra.c @@ -379,10 +379,11 @@ void eigrp_zebra_route_add(struct prefix *p, struct list *successors) memcpy(&api.prefix, p, sizeof(*p)); SET_FLAG(api.message, ZAPI_MESSAGE_NEXTHOP); - api.nexthop_num = successors->count; /* Nexthop, ifindex, distance and metric information. */ for (ALL_LIST_ELEMENTS_RO(successors, node, te)) { + if (count >= MULTIPATH_NUM) + break; api_nh = &api.nexthops[count]; if (te->adv_router->src.s_addr) { api_nh->gate.ipv4 = te->adv_router->src; @@ -393,6 +394,7 @@ void eigrp_zebra_route_add(struct prefix *p, struct list *successors) count++; } + api.nexthop_num = count; if (IS_DEBUG_EIGRP(zebra, ZEBRA_REDISTRIBUTE)) { char buf[2][PREFIX_STRLEN]; |