diff options
| author |   Florin Coras <fcoras@cisco.com> | 2020-03-31 01:49:40 +0000 |
|---|---|---|
| committer |   Dave Barach <openvpp@barachs.net> | 2020-03-31 20:24:40 +0000 |
| commit | 936197467aac08b7620c9cb0614817b90466968e (patch) | |
| tree | 00593356300880d20bd976b46a30815d83daf6ed | |
| parent | 8c18f85d325d9c10c8ba695e51925a21f173fbb8 (diff) | |
udp: validate input data length
Type: fix
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I3f34011ca61ded310d0411e7b50548982bd164ac
| -rw-r--r-- | src/vnet/udp/udp_input.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/vnet/udp/udp_input.c b/src/vnet/udp/udp_input.c index bd4e75710f5..453e123f02e 100644 --- a/src/vnet/udp/udp_input.c +++ b/src/vnet/udp/udp_input.c @@ -89,7 +89,7 @@ udp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, while (n_left_from > 0) { - u32 bi0, fib_index0; + u32 bi0, fib_index0, data_len; vlib_buffer_t *b0; u32 error0 = UDP_ERROR_ENQUEUED; udp_header_t *udp0; @@ -125,7 +125,8 @@ udp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, udp0->src_port, TRANSPORT_PROTO_UDP); lcl_addr = &ip40->dst_address; rmt_addr = &ip40->src_address; - + data_len = clib_net_to_host_u16 (ip40->length); + data_len -= sizeof (ip4_header_t) + sizeof (udp_header_t); } else { @@ -135,6 +136,8 @@ udp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, udp0->src_port, TRANSPORT_PROTO_UDP); lcl_addr = &ip60->dst_address; rmt_addr = &ip60->src_address; + data_len = clib_net_to_host_u16 (ip60->payload_length); + data_len -= sizeof (udp_header_t); } if (PREDICT_FALSE (!s0)) @@ -228,12 +231,12 @@ udp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, if (svm_fifo_max_enqueue_prod (s0->rx_fifo) - < b0->current_length + sizeof (session_dgram_hdr_t)) + < data_len + sizeof (session_dgram_hdr_t)) { error0 = UDP_ERROR_FIFO_FULL; goto trace0; } - hdr0.data_length = b0->current_length; + hdr0.data_length = b0->current_length = data_len; hdr0.data_offset = 0; ip_set (&hdr0.lcl_ip, lcl_addr, is_ip4); ip_set (&hdr0.rmt_ip, rmt_addr, is_ip4); |