From 755042dec0fcc733d456adc2a74042c529eff039 Mon Sep 17 00:00:00 2001 From: Klement Sekera Date: Wed, 1 Dec 2021 10:14:38 +0000 Subject: ip: reassembly: drop zero length fragments Zero length fragments are invalid and should be dropped. This patch adds that. Type: improvement Change-Id: Ic6466c39ca8bf376efe06bb3b7f5d7f1ae812866 Signed-off-by: Klement Sekera --- src/vnet/ip/reass/ip6_sv_reass.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/vnet/ip/reass/ip6_sv_reass.c') diff --git a/src/vnet/ip/reass/ip6_sv_reass.c b/src/vnet/ip/reass/ip6_sv_reass.c index 3656c5a8f61..58c7d8d8433 100644 --- a/src/vnet/ip/reass/ip6_sv_reass.c +++ b/src/vnet/ip/reass/ip6_sv_reass.c @@ -41,6 +41,7 @@ typedef enum IP6_SV_REASS_RC_TOO_MANY_FRAGMENTS, IP6_SV_REASS_RC_INTERNAL_ERROR, IP6_SV_REASS_RC_UNSUPP_IP_PROTO, + IP6_SV_REASS_RC_INVALID_FRAG_LEN, } ip6_sv_reass_rc_t; typedef struct @@ -400,6 +401,10 @@ ip6_sv_reass_update (vlib_main_t *vm, vlib_node_runtime_t *node, u32 fragment_length = vlib_buffer_length_in_chain (vm, fb) - (fvnb->ip.reass.ip6_frag_hdr_offset + sizeof (*frag_hdr)); + if (0 == fragment_length) + { + return IP6_SV_REASS_RC_INVALID_FRAG_LEN; + } u32 fragment_last = fvnb->ip.reass.fragment_last = fragment_first + fragment_length - 1; fvnb->ip.reass.range_first = fragment_first; @@ -667,6 +672,9 @@ ip6_sv_reassembly_inline (vlib_main_t * vm, case IP6_SV_REASS_RC_INTERNAL_ERROR: counter = IP6_ERROR_REASS_INTERNAL_ERROR; break; + case IP6_SV_REASS_RC_INVALID_FRAG_LEN: + counter = IP6_ERROR_REASS_INVALID_FRAG_LEN; + break; } if (~0 != counter) { -- cgit 1.2.3-korg