summaryrefslogtreecommitdiffstats
path: root/src/plugins
diff options
context:
space:
mode:
authorFilip Varga <filip.varga@pantheon.tech>2018-11-05 09:41:56 +0100
committerDamjan Marion <dmarion@me.com>2018-11-06 14:14:03 +0000
commit3206bb15aa65f6b4bd933844cffc26967aab6ed6 (patch)
tree7660dd9e43a2a6814f0baa1602c3b1b29229cf2c /src/plugins
parent55c6c4a422f34365b2c32ad0a107a058aa64fd8d (diff)
VPP-1481: fixed tlv length checking & added tests
Change-Id: I9375bca5f5136c84d801dbd635929bb1c37d75b4 Signed-off-by: Filip Varga <filip.varga@pantheon.tech>
Diffstat (limited to 'src/plugins')
-rw-r--r--src/plugins/cdp/cdp_input.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/src/plugins/cdp/cdp_input.c b/src/plugins/cdp/cdp_input.c
index dd3619cb8ac..a27113d18eb 100644
--- a/src/plugins/cdp/cdp_input.c
+++ b/src/plugins/cdp/cdp_input.c
@@ -93,8 +93,11 @@ format_text_tlv (u8 * s, va_list * va)
s = format (s, "%s(%d): ", h->name, t->t);
- for (i = 0; i < (t->l - sizeof (*t)); i++)
- vec_add1 (s, t->v[i]);
+ if (t->l >= 4)
+ {
+ for (i = 0; i < (t->l - sizeof (*t)); i++)
+ vec_add1 (s, t->v[i]);
+ }
vec_add1 (s, '\n');
return s;
@@ -284,9 +287,14 @@ cdp_packet_scan (cdp_main_t * cm, cdp_neighbor_t * n)
tlv->l = ntohs (tlv->l);
/* tlv length includes t, l and v */
+
+ if (tlv->l < 4)
+ return CDP_ERROR_BAD_TLV;
+
cur += tlv->l;
if ((cur - 1) > end)
return CDP_ERROR_BAD_TLV;
+
/*
* Only process known TLVs. In practice, certain
* devices send tlv->t = 0xFF, perhaps as an EOF of sorts.