diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-01-03 18:55:09 +0100 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-01-07 02:22:56 +0100 |
| commit | 4824d144b61e43ad6e29330e3cdf7c64c60e9d7d (patch) | |
| tree | 3383430e5699737578ee00aaa66d904b93979a6e /isisd/isis_dynhn.h | |
| parent | Merge pull request #5630 from slankdev/slankdev-bgpd-fix-large-rd (diff) | |
| download | frr-4824d144b61e43ad6e29330e3cdf7c64c60e9d7d.tar.xz frr-4824d144b61e43ad6e29330e3cdf7c64c60e9d7d.zip | |
zebra: Prevent zebra vxlan remote macip del buffer overflow
=================================================================
==13611==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe9e5c8694 at pc 0x0000004d18ac bp 0x7ffe9e5c8330 sp 0x7ffe9e5c7ae0
WRITE of size 17 at 0x7ffe9e5c8694 thread T0
#0 0x4d18ab in __asan_memcpy (/usr/lib/frr/zebra+0x4d18ab)
#1 0x7f16f04bd97f in stream_get2 /home/qlyoung/frr/lib/stream.c:277:2
#2 0x6410ec in zebra_vxlan_remote_macip_del /home/qlyoung/frr/zebra/zebra_vxlan.c:7718:4
#3 0x68fa98 in zserv_handle_commands /home/qlyoung/frr/zebra/zapi_msg.c:2611:3
#4 0x556add in main /home/qlyoung/frr/zebra/main.c:309:2
#5 0x7f16eea3bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
#6 0x431249 in _start (/usr/lib/frr/zebra+0x431249)
This decode is the result of a buffer overflow because we are
not checking ipa_len.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'isisd/isis_dynhn.h')
0 files changed, 0 insertions, 0 deletions