Module Name: src
Committed By: yamaguchi
Date: Thu Mar 31 01:59:05 UTC 2022
Modified Files:
src/sys/net/lagg: if_lagg_lacp.c
Log Message:
Added length check for safety
pointed out by k-goda@IIJ
To generate a diff of this commit:
cvs rdiff -u -r1.15 -r1.16 src/sys/net/lagg/if_lagg_lacp.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/lagg/if_lagg_lacp.c
diff -u src/sys/net/lagg/if_lagg_lacp.c:1.15 src/sys/net/lagg/if_lagg_lacp.c:1.16
--- src/sys/net/lagg/if_lagg_lacp.c:1.15 Thu Mar 31 01:40:34 2022
+++ src/sys/net/lagg/if_lagg_lacp.c Thu Mar 31 01:59:05 2022
@@ -1,4 +1,4 @@
-/* $NetBSD: if_lagg_lacp.c,v 1.15 2022/03/31 01:40:34 yamaguchi Exp $ */
+/* $NetBSD: if_lagg_lacp.c,v 1.16 2022/03/31 01:59:05 yamaguchi Exp $ */
/*-
* SPDX-License-Identifier: BSD-2-Clause-NetBSD
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_lagg_lacp.c,v 1.15 2022/03/31 01:40:34 yamaguchi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_lagg_lacp.c,v 1.16 2022/03/31 01:59:05 yamaguchi Exp $");
#ifdef _KERNEL_OPT
#include "opt_lagg.h"
@@ -430,6 +430,9 @@ tlv_parse(void *vp, size_t len, struct t
if (th->tlv_type == TLV_TYPE_TERMINATE)
break;
+ if (th->tlv_length <= 0)
+ break;
+
for (i = 0; list[i].tlv_t != TLV_TYPE_TERMINATE; i++) {
if (th->tlv_type != list[i].tlv_t)
continue;
