Skip to content

Some memory backport 8.2 #12086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ton31337 merged 3 commits into from
Oct 11, 2022
Merged

Some memory backport 8.2 #12086

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d8d77d3
ospfclient: Ensure ospf_apiclient_lsa_originate cannot accidently wri…
donaldsharp Jul 20, 2022
519929c
isisd: Ensure rcap is freed in error case
donaldsharp Jul 20, 2022
3c48216
bgpd: Make sure hdr length is at a minimum of what is expected
donaldsharp Jul 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions bgpd/bgp_packet.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2440,6 +2440,14 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
"%s CAPABILITY has action: %d, code: %u, length %u",
peer->host, action, hdr->code, hdr->length);

if (hdr->length < sizeof(struct capability_mp_data)) {
zlog_info(
"%s Capability structure is not properly filled out, expected at least %zu bytes but header length specified is %d",
peer->host, sizeof(struct capability_mp_data),
hdr->length);
return BGP_Stop;
}

/* Capability length check. */
if ((pnt + hdr->length + 3) > end) {
zlog_info("%s Capability length error", peer->host);
Expand Down
8 changes: 4 additions & 4 deletions isisd/isis_tlvs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2966,9 +2966,9 @@ static int pack_tlv_router_cap(const struct isis_router_cap *router_cap,
}

static int unpack_tlv_router_cap(enum isis_tlv_context context,
uint8_t tlv_type, uint8_t tlv_len,
struct stream *s, struct sbuf *log,
void *dest, int indent)
uint8_t tlv_type, uint8_t tlv_len,
struct stream *s, struct sbuf *log, void *dest,
int indent)
{
struct isis_tlvs *tlvs = dest;
struct isis_router_cap *rcap;
Expand Down Expand Up @@ -3013,7 +3013,7 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context,
log, indent,
"WARNING: Router Capability subTLV length too large compared to expected size\n");
stream_forward_getp(s, STREAM_READABLE(s));

XFREE(MTYPE_ISIS_TLV, rcap);
return 0;
}

Expand Down
6 changes: 6 additions & 0 deletions ospfclient/ospf_apiclient.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,6 +447,12 @@ int ospf_apiclient_lsa_originate(struct ospf_apiclient *oclient,
return OSPF_API_ILLEGALLSATYPE;
}

if ((size_t)opaquelen > sizeof(buf) - sizeof(struct lsa_header)) {
fprintf(stderr, "opaquelen(%d) is larger than buf size %zu\n",
opaquelen, sizeof(buf));
return OSPF_API_NOMEMORY;
}

/* Make a new LSA from parameters */
lsah = (struct lsa_header *)buf;
lsah->ls_age = 0;
Expand Down