From 826f2510e67711045e52cf4b5e3ddef514ed556e Mon Sep 17 00:00:00 2001 From: Iggy Frankovic Date: Thu, 30 May 2024 07:59:54 -0400 Subject: [PATCH] ospf6d: Prevent heap-buffer-overflow with unknown type When parsing a osf6 grace lsa field and we receive an unknown tlv type, ospf6d was not incrementing the pointer to get beyond the tlv. Leaving a situation where ospf6d would parse the packet incorrectly. Signed-off-by: Iggy Frankovic --- ospf6d/ospf6_gr_helper.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ospf6d/ospf6_gr_helper.c b/ospf6d/ospf6_gr_helper.c index 229e0a4db8ab..f0e5d3a15c24 100644 --- a/ospf6d/ospf6_gr_helper.c +++ b/ospf6d/ospf6_gr_helper.c @@ -176,6 +176,7 @@ static int ospf6_extract_grace_lsa_fields(struct ospf6_lsa *lsa, return OSPF6_FAILURE; break; default: + sum += TLV_SIZE(tlvh); if (IS_DEBUG_OSPF6_GR) zlog_debug("%s, Ignoring unknown TLV type:%d", __func__, ntohs(tlvh->type));