mirrors/bird
mirrors/bird
0
0
Fork 0
mirror of https://gitlab.nic.cz/labs/bird.git synced 2024-12-22 17:51:53 +00:00
Code Releases Activity

BGP: Fix bugs in handling of shutdown messages

Browse Source 
There is an improper check for valid message size, which may lead to
stack overflow and buffer leaks to log when a large message is received.

Thanks to Daniel McCarney for bugreport and analysis.
This commit is contained in:
Ondrej Zajicek (work) 2019-09-09 03:48:27 +02:00
parent 7300d79be9
commit 1657c41c96
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
proto/bgp/packets.c
View File

@ -1539,7 +1539,7 @@ bgp_handle_message(struct bgp_proto *p, byte *data, uint len, byte **bp)
return 1; return 1;
/* Handle proper message */ /* Handle proper message */
if ((msg_len > 255) && (msg_len + 1 > len)) if (msg_len + 1 > len)
return 0; return 0;
/* Some elementary cleanup */ /* Some elementary cleanup */
@ -1555,7 +1555,7 @@ bgp_handle_message(struct bgp_proto *p, byte *data, uint len, byte **bp)
void void
bgp_log_error(struct bgp_proto *p, u8 class, char *msg, unsigned code, unsigned subcode, byte *data, unsigned len) bgp_log_error(struct bgp_proto *p, u8 class, char *msg, unsigned code, unsigned subcode, byte *data, unsigned len)
{ {
byte argbuf[256], *t = argbuf; byte argbuf[256+16], *t = argbuf;
unsigned i; unsigned i;
/* Don't report Cease messages generated by myself */ /* Don't report Cease messages generated by myself */