Merge pull request #15139 from FRRouting/mergify/bp/stable/9.1/pr-15091

bgpd: fix ecommunity_fill_pbr_action heap-buffer-overflow (backport #15091)
FRRouting · Jan 12, 2024 · f8cce37 · f8cce37
2 parents c066b83 + 26187b0
commit f8cce37
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/bgpd/bgp_ecommunity.c b/bgpd/bgp_ecommunity.c
@@ -1581,8 +1581,8 @@ int ecommunity_fill_pbr_action(struct ecommunity_val *ecom_eval,
 		 * in the 'Network Address of Next- Hop'
 		 * field of the associated MP_REACH_NLRI.
 		 */
-		struct ecommunity_ip *ip_ecom = (struct ecommunity_ip *)
-			ecom_eval + 2;
+		struct ecommunity_ip *ip_ecom =
+			(struct ecommunity_ip *)&ecom_eval->val[2];
 
 		api->u.zr.redirect_ip_v4 = ip_ecom->ip;
 	} else