aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndrew Yourtchenko <ayourtch@gmail.com>2022-08-23 16:51:12 +0000
committerFlorin Coras <florin.coras@gmail.com>2022-08-23 18:25:48 +0000
commit1a1c59d1a20ce834ee2296e9b12321410bbabac9 (patch)
tree2219ba783c931ce7a897fe94ff5eb8c018bb383c
parenta6b2d7ed5a5d20ddb1133da4a153e319151e41e9 (diff)
lisp: address the issues raised by coverity 249165
Add the error checks in parsing, aimed to avoid parser walking past the end of packet in case the data is garbage. Type: fix Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com> Change-Id: I9541b555a18baf63cb8081bcd7a4c2750f2ed012
-rw-r--r--src/plugins/lisp/lisp-cp/lisp_msg_serdes.c16
1 files changed, 12 insertions, 4 deletions
diff --git a/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c b/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c
index 14d90982d4f..509462d8e23 100644
--- a/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c
+++ b/src/plugins/lisp/lisp-cp/lisp_msg_serdes.c
@@ -264,9 +264,14 @@ lisp_msg_parse_addr (vlib_buffer_t * b, gid_address_t * eid)
u32 len;
clib_memset (eid, 0, sizeof (*eid));
len = gid_address_parse (vlib_buffer_get_current (b), eid);
- if (len != ~0)
- vlib_buffer_pull (b, len);
- return len;
+ if ((len != ~0) && vlib_buffer_pull (b, len))
+ {
+ return len;
+ }
+ else
+ {
+ return ~0;
+ }
}
u32
@@ -280,7 +285,10 @@ lisp_msg_parse_eid_rec (vlib_buffer_t * b, gid_address_t * eid)
return len;
gid_address_ippref_len (eid) = EID_REC_MLEN (h);
- vlib_buffer_pull (b, len + sizeof (eid_record_hdr_t));
+ if (!vlib_buffer_pull (b, len + sizeof (eid_record_hdr_t)))
+ {
+ return ~0;
+ }
return len + sizeof (eid_record_hdr_t);
}