matthieu/frr
1
0
Fork 0
forked from Mirror/frr
Code Pull requests Activity

ospfd: Fix Coverity SA #1617470, 76 and 78

Browse source 
msg_new takes a uint16_t, the length passed
down variable is a unsigned int, thus 32 bit.
It's possible, but highly unlikely, that the
msglen could be greater than 16 bit.
Let's just add some checks to ensure that
this could not happen.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit 283cc51178)
This commit is contained in:
Donald Sharp 2025-01-15 11:16:10 -05:00 committed by Mergify
parent 62e01a8982
commit 01af91e5ff
1 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
ospfd/ospf_api.c
View file

@ -514,6 +514,12 @@ struct msg *new_msg_originate_request(uint32_t seqnum, struct in_addr ifaddr,
omsglen += sizeof(struct msg_originate_request)
- sizeof(struct lsa_header);
if (omsglen > UINT16_MAX) {
zlog_warn("%s: LSA specified is bigger than maximum LSA size, something is wrong",
__func__);
omsglen = UINT16_MAX;
}
return msg_new(MSG_ORIGINATE_REQUEST, omsg, seqnum, omsglen);
}
@ -639,6 +645,12 @@ struct msg *new_msg_lsa_change_notify(uint8_t msgtype, uint32_t seqnum,
memcpy(nmsg_data, data, len);
len += sizeof(struct msg_lsa_change_notify) - sizeof(struct lsa_header);
if (len > UINT16_MAX) {
zlog_warn("%s: LSA specified is bigger than maximum LSA size, something is wrong",
__func__);
len = UINT16_MAX;
}
return msg_new(msgtype, nmsg, seqnum, len);
}
@ -666,6 +678,12 @@ struct msg *new_msg_reachable_change(uint32_t seqnum, uint16_t nadd,
nmsg->nremove = htons(nremove);
len = sizeof(*nmsg) + insz * (nadd + nremove);
if (len > UINT16_MAX) {
zlog_warn("%s: LSA specified is bigger than maximum LSA size, something is wrong",
__func__);
len = UINT16_MAX;
}
return msg_new(MSG_REACHABLE_CHANGE, nmsg, seqnum, len);
}