diff options
| author | David Lamparter <equinox@opensourcerouting.org> | 2012-05-08 06:27:04 +0200 |
|---|---|---|
| committer | David Lamparter <equinox@opensourcerouting.org> | 2012-10-25 19:15:59 +0200 |
| commit | 948b6bef7f9cf841a98fe3ea40419696500c8c4c (patch) | |
| tree | 9dbdadff242010472e298b624e20e52bd5625328 /isisd/isis_spf.c | |
| parent | isisd: fix null pointer dereference in send_lsp() (diff) | |
| download | frr-948b6bef7f9cf841a98fe3ea40419696500c8c4c.tar.xz frr-948b6bef7f9cf841a98fe3ea40419696500c8c4c.zip | |
isisd: pull up invalid prefix assert()
processing invalid prefixes causes isisd to assert() or otherwise
misbehave in ip_masklen/apply_mask. pull up the assert() to indicate
better there's broken data in isisd's LSDB.
* isisd/isis_spf.c: assert() prefix lengths
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
Diffstat (limited to 'isisd/isis_spf.c')
| -rw-r--r-- | isisd/isis_spf.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/isisd/isis_spf.c b/isisd/isis_spf.c index 198104a98..eff7c4761 100644 --- a/isisd/isis_spf.c +++ b/isisd/isis_spf.c @@ -813,6 +813,8 @@ lspfragloop: for (ALL_LIST_ELEMENTS_RO (lsp->tlv_data.te_ipv4_reachs, node, te_ipv4_reach)) { + assert ((te_ipv4_reach->control & 0x3F) <= IPV4_MAX_BITLEN); + dist = cost + ntohl (te_ipv4_reach->te_metric); vtype = VTYPE_IPREACH_TE; prefix.u.prefix4 = newprefix2inaddr (&te_ipv4_reach->prefix_start, @@ -829,6 +831,8 @@ lspfragloop: prefix.family = AF_INET6; for (ALL_LIST_ELEMENTS_RO (lsp->tlv_data.ipv6_reachs, node, ip6reach)) { + assert (ip6reach->prefix_len <= IPV6_MAX_BITLEN); + dist = cost + ip6reach->metric; vtype = (ip6reach->control_info & CTRL_INFO_DISTRIBUTION) ? VTYPE_IP6REACH_EXTERNAL : VTYPE_IP6REACH_INTERNAL; |