Skip to content

Commit

Permalink
Merge pull request #16786 from FRRouting/mergify/bp/stable/9.0/pr-16718
Browse files Browse the repository at this point in the history
isisd: fix crash when reading asla (backport #16718)
  • Loading branch information
ton31337 authored Sep 11, 2024
2 parents ef60abb + 4a1bfe0 commit b28f754
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 2 deletions.
13 changes: 11 additions & 2 deletions isisd/isis_tlvs.c
Original file line number Diff line number Diff line change
Expand Up @@ -1131,8 +1131,8 @@ static int unpack_item_ext_subtlv_asla(uint16_t mtid, uint8_t subtlv_len,
uint8_t sabm_flag_len;
/* User-defined App Identifier Bit Flags/Length */
uint8_t uabm_flag_len;
uint8_t sabm[ASLA_APP_IDENTIFIER_BIT_LENGTH] = {0};
uint8_t uabm[ASLA_APP_IDENTIFIER_BIT_LENGTH] = {0};
uint8_t sabm[ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH] = { 0 };
uint8_t uabm[ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH] = { 0 };
uint8_t readable = subtlv_len;
uint8_t subsubtlv_type;
uint8_t subsubtlv_len;
Expand Down Expand Up @@ -1163,6 +1163,15 @@ static int unpack_item_ext_subtlv_asla(uint16_t mtid, uint8_t subtlv_len,
return -1;
}

if ((asla->standard_apps_length > ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH) ||
(asla->user_def_apps_length > ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH)) {
zlog_err("Standard or User-Defined Application Identifier Bit Mask Length greater than %u bytes. Received respectively a length of %u and %u bytes.",
ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH,
asla->standard_apps_length, asla->user_def_apps_length);
stream_forward_getp(s, readable);
return -1;
}

for (int i = 0; i < asla->standard_apps_length; i++)
sabm[i] = stream_getc(s);
for (int i = 0; i < asla->user_def_apps_length; i++)
Expand Down
1 change: 1 addition & 0 deletions isisd/isis_tlvs.h
Original file line number Diff line number Diff line change
Expand Up @@ -560,6 +560,7 @@ struct isis_ext_subtlvs {
#define ISIS_SABM_FLAG_X 0x10 /* Flex-Algorithm - RFC9350 */

#define ASLA_APP_IDENTIFIER_BIT_LENGTH 1
#define ASLA_APP_IDENTIFIER_BIT_MAX_LENGTH 8
#define ASLA_LEGACY_FLAG 0x80
#define ASLA_APPS_LENGTH_MASK 0x7f

Expand Down

0 comments on commit b28f754

Please sign in to comment.