diff options
| author |   claudio <claudio@openbsd.org> | 2020-05-06 14:40:54 +0000 |
|---|---|---|
| committer | claudio <claudio@openbsd.org> | 2020-05-06 14:40:54 +0000 |
| commit | 07669e8b3af732f05a181ba4170be73c254ea6b5 (patch) | |
| tree | d7083003f9dc90e256b74e84b909ede5125806dd /usr.sbin/ospfd/lsupdate.c | |
| parent | rpki-client is only interested in real files. Don't tell rsync to (diff) | |
| download | wireguard-openbsd-07669e8b3af732f05a181ba4170be73c254ea6b5.tar.xz wireguard-openbsd-07669e8b3af732f05a181ba4170be73c254ea6b5.zip | |
Do not use the pointer returned by ibuf_reserve() after calling another
ibuf function. After the call the internal buffer may have moved by realloc()
and so the pointer is invalid. Instead use ibuf_size() to get the current
offset in the buffer and use ibuf_seek() later on to write back the updated
lsa age into the buffer at the right spot.
This fixes an issue seen by Richard Chivers on routers with many passive
interfaces.
OK stsp@ deraadt@
Diffstat (limited to 'usr.sbin/ospfd/lsupdate.c')
| -rw-r--r-- | usr.sbin/ospfd/lsupdate.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/usr.sbin/ospfd/lsupdate.c b/usr.sbin/ospfd/lsupdate.c index 953a070563e..2446a993f96 100644 --- a/usr.sbin/ospfd/lsupdate.c +++ b/usr.sbin/ospfd/lsupdate.c @@ -1,4 +1,4 @@ -/* $OpenBSD: lsupdate.c,v 1.47 2019/11/19 09:55:55 remi Exp $ */ +/* $OpenBSD: lsupdate.c,v 1.48 2020/05/06 14:40:54 claudio Exp $ */ /* * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org> @@ -175,8 +175,8 @@ int add_ls_update(struct ibuf *buf, struct iface *iface, void *data, u_int16_t len, u_int16_t older) { - void *lsage; - u_int16_t age; + size_t ageoff; + u_int16_t age; if ((size_t)iface->mtu < sizeof(struct ip) + sizeof(struct ospf_hdr) + sizeof(u_int32_t) + ibuf_size(buf) + len + MD5_DIGEST_LENGTH) { @@ -186,7 +186,7 @@ add_ls_update(struct ibuf *buf, struct iface *iface, void *data, u_int16_t len, return (0); } - lsage = ibuf_reserve(buf, 0); + ageoff = ibuf_size(buf); if (ibuf_add(buf, data, len)) { log_warn("add_ls_update"); return (0); @@ -198,7 +198,7 @@ add_ls_update(struct ibuf *buf, struct iface *iface, void *data, u_int16_t len, if ((age += older + iface->transmit_delay) >= MAX_AGE) age = MAX_AGE; age = htons(age); - memcpy(lsage, &age, sizeof(age)); + memcpy(ibuf_seek(buf, ageoff, sizeof(age)), &age, sizeof(age)); return (1); } |