Skip to content

Commit 359892f

Browse files
Iggy Frankovicmergify[bot]
authored andcommitted
ospf6d: Prevent heap-buffer-overflow with unknown type
When parsing a osf6 grace lsa field and we receive an unknown tlv type, ospf6d was not incrementing the pointer to get beyond the tlv. Leaving a situation where ospf6d would parse the packet incorrectly. Signed-off-by: Iggy Frankovic <iggy07@gmail.com> (cherry picked from commit 826f251)
1 parent d3aead4 commit 359892f

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

ospf6d/ospf6_gr_helper.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,7 @@ static int ospf6_extract_grace_lsa_fields(struct ospf6_lsa *lsa,
176176
return OSPF6_FAILURE;
177177
break;
178178
default:
179+
sum += TLV_SIZE(tlvh);
179180
if (IS_DEBUG_OSPF6_GR)
180181
zlog_debug("%s, Ignoring unknown TLV type:%d",
181182
__func__, ntohs(tlvh->type));

0 commit comments

Comments
 (0)