Add missing check if the UDP packet contains the right amount of
data to safely deref part of the packet buffer.
Fixes: 02839c4d8934 ("controller: bfd: introduce BFD state machine.")
Reported-by: Seiji Sakurai <[email protected]>
Acked-by: Dumitru Ceara <[email protected]>
Signed-off-by: Ales Musil <[email protected]>
---
controller/pinctrl.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/controller/pinctrl.c b/controller/pinctrl.c
index de52ac87f..1a5407183 100644
--- a/controller/pinctrl.c
+++ b/controller/pinctrl.c
@@ -7697,6 +7697,13 @@ pinctrl_check_bfd_msg(const struct flow *ip_flow, struct
dp_packet *pkt_in)
return false;
}
+ size_t dlen = MIN(ntohs(udp_hdr->udp_len), dp_packet_l4_size(pkt_in));
+ if (dlen < UDP_HEADER_LEN + sizeof (struct bfd_msg)) {
+ VLOG_DBG_RL(&rl, "BFD action on malformed BFD msg (%"PRIxSIZE")",
+ dlen);
+ return false;
+ }
+
const struct bfd_msg *msg = dp_packet_get_udp_payload(pkt_in);
uint8_t version = msg->vers_diag >> 5;
if (version != BFD_VERSION) {
--
2.53.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
