From 8464f45a26426c2eb56f27d34847a5ba5569dc28 Mon Sep 17 00:00:00 2001 From: Louis Scalbert Date: Thu, 28 Sep 2023 16:55:43 +0200 Subject: [PATCH] bgpd: fix insecure data write with area addresses Fix an issue where an attacker may inject a tainted length value to corrupt the memory. > CID 1568380 (#1 of 1): Untrusted value as argument (TAINTED_SCALAR) > 9. tainted_data: Passing tainted expression length to bgp_linkstate_nlri_value_display, which uses it as an offset Fixes: 8b531b1107 ("bgpd: store and send bgp link-state attributes") Signed-off-by: Louis Scalbert --- bgpd/bgp_linkstate_tlv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/bgpd/bgp_linkstate_tlv.c b/bgpd/bgp_linkstate_tlv.c index 11aeb1cf41b8..de7f8479bb37 100644 --- a/bgpd/bgp_linkstate_tlv.c +++ b/bgpd/bgp_linkstate_tlv.c @@ -1528,6 +1528,11 @@ static void bgp_linkstate_tlv_isis_area_indentifier_display(struct vty *vty, { struct iso_address addr; + if (length > sizeof(addr.area_addr)) { + bgp_linkstate_tlv_hexa_display(vty, pnt, length, json); + return; + } + addr.addr_len = length; memcpy(addr.area_addr, pnt, length);