| Andrew Geissler | 5082cc7 | 2023-09-11 08:41:39 -0400 | [diff] [blame] | 1 | From e61593f2ded104c4c7f01eb93e2b404e93e0c560 Mon Sep 17 00:00:00 2001 |
| 2 | From: harryreps <harryreps@gmail.com> |
| 3 | Date: Fri, 3 Mar 2023 23:17:14 +0000 |
| 4 | Subject: [PATCH] babeld: fix #11808 to avoid infinite loops |
| 5 | |
| 6 | Replacing continue in loops to goto done so that index of packet buffer |
| 7 | increases. |
| 8 | |
| 9 | Signed-off-by: harryreps <harryreps@gmail.com> |
| 10 | |
| 11 | CVE: CVE-2023-3748 |
| 12 | |
| 13 | Upstream-Status: Backport |
| 14 | [https://github.com/FRRouting/frr/commit/ae1e0e1fed77716bc06f181ad68c4433fb5523d0] |
| 15 | |
| 16 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> |
| 17 | --- |
| 18 | babeld/message.c | 6 +++--- |
| 19 | 1 file changed, 3 insertions(+), 3 deletions(-) |
| 20 | |
| 21 | diff --git a/babeld/message.c b/babeld/message.c |
| 22 | index 7d45d91bf..2bf233796 100644 |
| 23 | --- a/babeld/message.c |
| 24 | +++ b/babeld/message.c |
| 25 | @@ -439,7 +439,7 @@ parse_packet(const unsigned char *from, struct interface *ifp, |
| 26 | debugf(BABEL_DEBUG_COMMON, |
| 27 | "Received Hello from %s on %s that does not have all 0's in the unused section of flags, ignoring", |
| 28 | format_address(from), ifp->name); |
| 29 | - continue; |
| 30 | + goto done; |
| 31 | } |
| 32 | |
| 33 | /* |
| 34 | @@ -451,7 +451,7 @@ parse_packet(const unsigned char *from, struct interface *ifp, |
| 35 | debugf(BABEL_DEBUG_COMMON, |
| 36 | "Received Unicast Hello from %s on %s that FRR is not prepared to understand yet", |
| 37 | format_address(from), ifp->name); |
| 38 | - continue; |
| 39 | + goto done; |
| 40 | } |
| 41 | |
| 42 | DO_NTOHS(seqno, message + 4); |
| 43 | @@ -469,7 +469,7 @@ parse_packet(const unsigned char *from, struct interface *ifp, |
| 44 | debugf(BABEL_DEBUG_COMMON, |
| 45 | "Received hello from %s on %s should be ignored as that this version of FRR does not know how to properly handle interval == 0", |
| 46 | format_address(from), ifp->name); |
| 47 | - continue; |
| 48 | + goto done; |
| 49 | } |
| 50 | |
| 51 | changed = update_neighbour(neigh, seqno, interval); |
| 52 | -- |
| 53 | 2.25.1 |
| 54 | |