diff options
| author | Qian Chen <cq674350529@163.com> | 2022-12-20 09:36:08 -0500 |
|---|---|---|
| committer | Ilya Maximets <i.maximets@ovn.org> | 2022-12-20 17:29:13 +0100 |
| commit | f24527c9b4e81737708fb19e6feb104dd3ed1d2b (patch) | |
| tree | 5c7e2e56b2e43041212b7368d2bd023c842d4c0c /lib/lldp/lldp.c | |
| parent | 981ca96a5567d9690ff74b35cdca0898e669d81b (diff) | |
| download | openvswitch-f24527c9b4e81737708fb19e6feb104dd3ed1d2b.tar.gz | |
lldp: Fix bugs when parsing malformed AutoAttach.
The OVS LLDP implementation includes support for AutoAttach standard, which
the 'upstream' lldpd project does not include. As part of adding this
support, the message parsing for these TLVs did not include proper length
checks for the LLDP_TLV_AA_ELEMENT_SUBTYPE and the
LLDP_TLV_AA_ISID_VLAN_ASGNS_SUBTYPE elements. The result is that a message
without a proper boundary will cause an overread of memory, and lead to
undefined results, including crashes or other unidentified behavior.
The fix is to introduce proper bounds checking for these elements. Introduce
a unit test to ensure that we have some proper rejection in this code
base in the future.
Fixes: be53a5c447c3 ("auto-attach: Initial support for Auto-Attach standard")
Signed-off-by: Qian Chen <cq674350529@163.com>
Co-authored-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Diffstat (limited to 'lib/lldp/lldp.c')
| -rw-r--r-- | lib/lldp/lldp.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/lldp/lldp.c b/lib/lldp/lldp.c index dfeb2a800..6fdcfef56 100644 --- a/lib/lldp/lldp.c +++ b/lib/lldp/lldp.c @@ -583,6 +583,7 @@ lldp_decode(struct lldpd *cfg OVS_UNUSED, char *frame, int s, switch(tlv_subtype) { case LLDP_TLV_AA_ELEMENT_SUBTYPE: + CHECK_TLV_SIZE(50, "ELEMENT"); PEEK_BYTES(&msg_auth_digest, sizeof msg_auth_digest); aa_element_dword = PEEK_UINT32; @@ -629,6 +630,7 @@ lldp_decode(struct lldpd *cfg OVS_UNUSED, char *frame, int s, break; case LLDP_TLV_AA_ISID_VLAN_ASGNS_SUBTYPE: + CHECK_TLV_SIZE(36, "ISID_VLAN_ASGNS"); PEEK_BYTES(&msg_auth_digest, sizeof msg_auth_digest); /* Subtract off tlv type and length (2Bytes) + OUI (3B) + |