Blame 0001-bgpd-security-fix-infinite-loop-on-certain-invalid-O.patch
|
 |
ba3a7a2 |
From ce07207c50a3d1f05d6dd49b5294282e59749787 Mon Sep 17 00:00:00 2001
|
|
|
ba3a7a2 |
From: Paul Jakma <paul@jakma.org>
|
|
|
ba3a7a2 |
Date: Sat, 6 Jan 2018 21:20:51 +0000
|
|
|
ba3a7a2 |
Subject: [PATCH] bgpd/security: fix infinite loop on certain invalid OPEN
|
|
|
ba3a7a2 |
messages
|
|
|
ba3a7a2 |
|
|
|
ba3a7a2 |
Security issue: Quagga-2018-1975
|
|
|
ba3a7a2 |
See: https://www.quagga.net/security/Quagga-2018-1975.txt
|
|
|
ba3a7a2 |
|
|
|
ba3a7a2 |
* bgpd/bgp_packet.c: (bgp_capability_msg_parse) capability parser can infinite
|
|
|
ba3a7a2 |
loop due to checks that issue 'continue' without bumping the input
|
|
|
ba3a7a2 |
pointer.
|
|
|
ba3a7a2 |
---
|
|
|
ba3a7a2 |
bgpd/bgp_packet.c | 4 ++--
|
|
|
ba3a7a2 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
ba3a7a2 |
|
|
|
ba3a7a2 |
diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
|
|
|
ba3a7a2 |
index b3d601fc..f9338d8d 100644
|
|
|
ba3a7a2 |
--- a/bgpd/bgp_packet.c
|
|
|
ba3a7a2 |
+++ b/bgpd/bgp_packet.c
|
|
|
ba3a7a2 |
@@ -2328,7 +2328,8 @@ bgp_capability_msg_parse (struct peer *peer, u_char *pnt, bgp_size_t length)
|
|
|
ba3a7a2 |
|
|
|
ba3a7a2 |
end = pnt + length;
|
|
|
ba3a7a2 |
|
|
|
ba3a7a2 |
- while (pnt < end)
|
|
|
ba3a7a2 |
+ /* XXX: Streamify this */
|
|
|
ba3a7a2 |
+ for (; pnt < end; pnt += hdr->length + 3)
|
|
|
ba3a7a2 |
{
|
|
|
ba3a7a2 |
/* We need at least action, capability code and capability length. */
|
|
|
ba3a7a2 |
if (pnt + 3 > end)
|
|
|
ba3a7a2 |
@@ -2416,7 +2417,6 @@ bgp_capability_msg_parse (struct peer *peer, u_char *pnt, bgp_size_t length)
|
|
|
ba3a7a2 |
zlog_warn ("%s unrecognized capability code: %d - ignored",
|
|
|
ba3a7a2 |
peer->host, hdr->code);
|
|
|
ba3a7a2 |
}
|
|
|
ba3a7a2 |
- pnt += hdr->length + 3;
|
|
|
ba3a7a2 |
}
|
|
|
ba3a7a2 |
return 0;
|
|
|
ba3a7a2 |
}
|
|
|
ba3a7a2 |
--
|
|
|
ba3a7a2 |
2.14.3
|
|
|
ba3a7a2 |
|