@@ -, +, @@ 

    bgpd: CVE-2012-1820, DoS in bgp_capability_orf()

    An ORF (code 3) capability TLV is defined to contain exactly one

    AFI/SAFI block. Function bgp_capability_orf(), which parses ORF

    capability TLV, uses do-while cycle to call its helper function

    bgp_capability_orf_entry(), which actually processes the AFI/SAFI data

    block. The call is made at least once and repeated as long as the input

    buffer has enough data for the next call.

    The helper function, bgp_capability_orf_entry(), uses "Number of ORFs"

    field of the provided AFI/SAFI block to verify, if it fits the input

    buffer. However, the check is made based on the total length of the ORF

    TLV regardless of the data already consumed by the previous helper

    function call(s). This way, the check condition is only valid for the

    first AFI/SAFI block inside an ORF capability TLV.

    For the subsequent calls of the helper function, if any are made, the

    check condition may erroneously tell, that the current "Number of ORFs"

    field fits the buffer boundary, where in fact it does not. This makes it

    possible to trigger an assertion by feeding an OPEN message with a

    specially-crafted malformed ORF capability TLV.

    This commit fixes the vulnerability by making the implementation follow

    the spec.

--- a/bgpd/bgp_open.c	

+++ a/bgpd/bgp_open.c	

@@ -231,7 +231,7 @@ bgp_capability_orf_entry (struct peer *peer, struct capability_header *hdr)

     }

   /* validate number field */

-  if (sizeof (struct capability_orf_entry) + (entry.num * 2) > hdr->length)

+  if (sizeof (struct capability_orf_entry) + (entry.num * 2) != hdr->length)

     {

       zlog_info ("%s ORF Capability entry length error,"

                  " Cap length %u, num %u",

@@ -335,28 +335,6 @@ bgp_capability_orf_entry (struct peer *peer, struct capability_header *hdr)

 }

 static int

-bgp_capability_orf (struct peer *peer, struct capability_header *hdr)

-{

-  struct stream *s = BGP_INPUT (peer);

-  size_t end = stream_get_getp (s) + hdr->length;

-  

-  assert (stream_get_getp(s) + sizeof(struct capability_orf_entry) <= end);

-  

-  /* We must have at least one ORF entry, as the caller has already done

-   * minimum length validation for the capability code - for ORF there must

-   * at least one ORF entry (header and unknown number of pairs of bytes).

-   */

-  do

-    {

-      if (bgp_capability_orf_entry (peer, hdr) == -1)

-        return -1;

-    } 

-  while (stream_get_getp(s) + sizeof(struct capability_orf_entry) < end);

-  

-  return 0;

-}

-

-static int

 bgp_capability_restart (struct peer *peer, struct capability_header *caphdr)

 {

   struct stream *s = BGP_INPUT (peer);

@@ -573,7 +551,7 @@ bgp_capability_parse (struct peer *peer, size_t length, int *mp_capability,

             break;

           case CAPABILITY_CODE_ORF:

           case CAPABILITY_CODE_ORF_OLD:

-            if (bgp_capability_orf (peer, &caphdr))

+            if (bgp_capability_orf_entry (peer, &caphdr))

               return -1;

             break;

           case CAPABILITY_CODE_RESTART: