Skip to content

proto_redistnum() uses strncmp() with invalid strlen assumption #9

Closed
@qlyoung

Description

@qlyoung

lib/log.c:

int
proto_redistnum(int afi, const char *s)
{
  if (! s)
    return -1;

  if (afi == AFI_IP)
    {
      if (strncmp (s, "k", 1) == 0)
        return ZEBRA_ROUTE_KERNEL;
      else if (strncmp (s, "c", 1) == 0)
        return ZEBRA_ROUTE_CONNECT;
      else if (strncmp (s, "s", 1) == 0)
        return ZEBRA_ROUTE_STATIC;
      else if (strncmp (s, "r", 1) == 0)
        return ZEBRA_ROUTE_RIP;
      else if (strncmp (s, "o", 1) == 0)
        return ZEBRA_ROUTE_OSPF;
      else if (strncmp (s, "i", 1) == 0)
        return ZEBRA_ROUTE_ISIS;
      else if (strncmp (s, "bg", 2) == 0)
        return ZEBRA_ROUTE_BGP;
      else if (strncmp (s, "ta", 2) == 0)
        return ZEBRA_ROUTE_TABLE;
      else if (strncmp (s, "v", 1) == 0)
        return ZEBRA_ROUTE_VNC;
      else if (strncmp (s, "vd", 1) == 0)
        return ZEBRA_ROUTE_VNC_DIRECT;
    }
  if (afi == AFI_IP6)
    {
      if (strncmp (s, "k", 1) == 0)
        return ZEBRA_ROUTE_KERNEL;
      else if (strncmp (s, "c", 1) == 0)
        return ZEBRA_ROUTE_CONNECT;
      else if (strncmp (s, "s", 1) == 0)
        return ZEBRA_ROUTE_STATIC;
      else if (strncmp (s, "r", 1) == 0)
        return ZEBRA_ROUTE_RIPNG;
      else if (strncmp (s, "o", 1) == 0)
        return ZEBRA_ROUTE_OSPF6;
      else if (strncmp (s, "i", 1) == 0)
        return ZEBRA_ROUTE_ISIS;
      else if (strncmp (s, "bg", 2) == 0)
        return ZEBRA_ROUTE_BGP;
      else if (strncmp (s, "ta", 2) == 0)
        return ZEBRA_ROUTE_TABLE;
      else if (strncmp (s, "v", 1) == 0)
        return ZEBRA_ROUTE_VNC;
      else if (strncmp (s, "vd", 1) == 0)
        return ZEBRA_ROUTE_VNC_DIRECT;
    }
  return -1;
}

This is called in many locations with raw user's CLI input. In cases where the user matches one of the calling commands with a single letter for the protocol name, this function will fail.

Checking 1 or 2 letters is not consistent and breaks some CLI completions.

Broken out from #20.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions