diff options
| author |   Filip Varga <filip.varga@pantheon.tech> | 2018-11-05 09:41:56 +0100 |
|---|---|---|
| committer |   Damjan Marion <dmarion@me.com> | 2018-11-06 14:14:03 +0000 |
| commit | 3206bb15aa65f6b4bd933844cffc26967aab6ed6 (patch) | |
| tree | 7660dd9e43a2a6814f0baa1602c3b1b29229cf2c /src/plugins/cdp/cdp_input.c | |
| parent | 55c6c4a422f34365b2c32ad0a107a058aa64fd8d (diff) | |
VPP-1481: fixed tlv length checking & added tests
Change-Id: I9375bca5f5136c84d801dbd635929bb1c37d75b4
Signed-off-by: Filip Varga <filip.varga@pantheon.tech>
Diffstat (limited to 'src/plugins/cdp/cdp_input.c')
| -rw-r--r-- | src/plugins/cdp/cdp_input.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/plugins/cdp/cdp_input.c b/src/plugins/cdp/cdp_input.c index dd3619cb8ac..a27113d18eb 100644 --- a/src/plugins/cdp/cdp_input.c +++ b/src/plugins/cdp/cdp_input.c @@ -93,8 +93,11 @@ format_text_tlv (u8 * s, va_list * va) s = format (s, "%s(%d): ", h->name, t->t); - for (i = 0; i < (t->l - sizeof (*t)); i++) - vec_add1 (s, t->v[i]); + if (t->l >= 4) + { + for (i = 0; i < (t->l - sizeof (*t)); i++) + vec_add1 (s, t->v[i]); + } vec_add1 (s, '\n'); return s; @@ -284,9 +287,14 @@ cdp_packet_scan (cdp_main_t * cm, cdp_neighbor_t * n) tlv->l = ntohs (tlv->l); /* tlv length includes t, l and v */ + + if (tlv->l < 4) + return CDP_ERROR_BAD_TLV; + cur += tlv->l; if ((cur - 1) > end) return CDP_ERROR_BAD_TLV; + /* * Only process known TLVs. In practice, certain * devices send tlv->t = 0xFF, perhaps as an EOF of sorts. |