diff options
| author |   Andrew Yourtchenko <ayourtch@gmail.com> | 2022-08-23 16:51:12 +0000 |
|---|---|---|
| committer |   Florin Coras <florin.coras@gmail.com> | 2022-08-23 18:25:48 +0000 |
| commit | 1a1c59d1a20ce834ee2296e9b12321410bbabac9 (patch) | |
| tree | 2219ba783c931ce7a897fe94ff5eb8c018bb383c | |
| parent | a6b2d7ed5a5d20ddb1133da4a153e319151e41e9 (diff) | |
lisp: address the issues raised by coverity 249165
Add the error checks in parsing, aimed to avoid parser walking past the end of packet in case the data
is garbage.
Type: fix
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Change-Id: I9541b555a18baf63cb8081bcd7a4c2750f2ed012
| -rw-r--r-- | src/plugins/lisp/lisp-cp/lisp_msg_serdes.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c b/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c index 14d90982d4f..509462d8e23 100644 --- a/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c +++ b/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c @@ -264,9 +264,14 @@ lisp_msg_parse_addr (vlib_buffer_t * b, gid_address_t * eid) u32 len; clib_memset (eid, 0, sizeof (*eid)); len = gid_address_parse (vlib_buffer_get_current (b), eid); - if (len != ~0) - vlib_buffer_pull (b, len); - return len; + if ((len != ~0) && vlib_buffer_pull (b, len)) + { + return len; + } + else + { + return ~0; + } } u32 @@ -280,7 +285,10 @@ lisp_msg_parse_eid_rec (vlib_buffer_t * b, gid_address_t * eid) return len; gid_address_ippref_len (eid) = EID_REC_MLEN (h); - vlib_buffer_pull (b, len + sizeof (eid_record_hdr_t)); + if (!vlib_buffer_pull (b, len + sizeof (eid_record_hdr_t))) + { + return ~0; + } return len + sizeof (eid_record_hdr_t); } |