diff options
| author | Mark Stapp <mjs@cisco.com> | 2024-06-05 20:37:41 +0200 |
|---|---|---|
| committer | Mark Stapp <mjs@cisco.com> | 2024-06-05 20:37:41 +0200 |
| commit | 28d2e126c7fea07de22e52201a70fbf0c94b5dc6 (patch) | |
| tree | 089b49b2bc0421d08e8c018603e695f5ec80a67c /zebra/dplane_fpm_nl.c | |
| parent | Merge pull request #16159 from opensourcerouting/fix/ignore_auto_created_vrf_... (diff) | |
| download | frr-28d2e126c7fea07de22e52201a70fbf0c94b5dc6.tar.xz frr-28d2e126c7fea07de22e52201a70fbf0c94b5dc6.zip | |
zebra: fix incoming FPM message length validation
Validate incoming message length against correct
(struct rtmsg) len, not top-level netlink message header size.
Signed-off-by: Mark Stapp <mjs@cisco.com>
Diffstat (limited to '')
| -rw-r--r-- | zebra/dplane_fpm_nl.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/zebra/dplane_fpm_nl.c b/zebra/dplane_fpm_nl.c index 245b799a9..9ad92d626 100644 --- a/zebra/dplane_fpm_nl.c +++ b/zebra/dplane_fpm_nl.c @@ -654,14 +654,6 @@ static void fpm_read(struct event *t) hdr_available_bytes = fpm.msg_len - FPM_MSG_HDR_LEN; available_bytes -= hdr_available_bytes; - /* Sanity check: must be at least header size. */ - if (hdr->nlmsg_len < sizeof(*hdr)) { - zlog_warn( - "%s: [seq=%u] invalid message length %u (< %zu)", - __func__, hdr->nlmsg_seq, hdr->nlmsg_len, - sizeof(*hdr)); - continue; - } if (hdr->nlmsg_len > fpm.msg_len) { zlog_warn( "%s: Received a inner header length of %u that is greater than the fpm total length of %u", @@ -691,6 +683,14 @@ static void fpm_read(struct event *t) switch (hdr->nlmsg_type) { case RTM_NEWROUTE: + /* Sanity check: need at least route msg header size. */ + if (hdr->nlmsg_len < sizeof(struct rtmsg)) { + zlog_warn("%s: [seq=%u] invalid message length %u (< %zu)", + __func__, hdr->nlmsg_seq, + hdr->nlmsg_len, sizeof(struct rtmsg)); + break; + } + ctx = dplane_ctx_alloc(); dplane_ctx_route_init(ctx, DPLANE_OP_ROUTE_NOTIFY, NULL, NULL); |