Skip to content

Commit

Permalink
pimd: When receiving a packet be more careful with length in pim_pim_…
Browse files Browse the repository at this point in the history
…packet

a) If the length passed is the header length then it is possible that
assignment of data will happen without data actually existing.

b) Just move the assignment to after we ensure that the pim packet
received is the minimum possible length that can be received.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
  • Loading branch information
donaldsharp committed Aug 30, 2023
1 parent 6ed4740 commit 3163c64
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions pimd/pim_pim.c
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ int pim_pim_packet(struct interface *ifp, uint8_t *buf, size_t len,
bool no_fwd;

#if PIM_IPV == 4
if (len < sizeof(*ip_hdr)) {
if (len <= sizeof(*ip_hdr)) {
if (PIM_DEBUG_PIM_PACKETS)
zlog_debug(
"PIM packet size=%zu shorter than minimum=%zu",
Expand Down Expand Up @@ -189,14 +189,14 @@ int pim_pim_packet(struct interface *ifp, uint8_t *buf, size_t len,
iovp->iov_len = pim_msg_len;
iovp++;

header = (struct pim_msg_header *)pim_msg;
if (pim_msg_len < PIM_PIM_MIN_LEN) {
if (PIM_DEBUG_PIM_PACKETS)
zlog_debug(
"PIM message size=%d shorter than minimum=%d",
pim_msg_len, PIM_PIM_MIN_LEN);
return -1;
}
header = (struct pim_msg_header *)pim_msg;

if (header->ver != PIM_PROTO_VERSION) {
if (PIM_DEBUG_PIM_PACKETS)
Expand Down

0 comments on commit 3163c64

Please sign in to comment.