Change #274962

Comments

OSPF: Add minimum length check for SID/Label Range and SR Local Block TLVs
The RI LSA parser passes tlv_length - 4 to
ospf_print_ri_lsa_sid_label_range_tlv() without first checking that
tlv_length >= 4. When tlv_length is 0-3, the unsigned subtraction wraps
to a large value, causing the called function's while loop to read past
the TLV boundary.

Add a minimum length check before the subtraction, consistent with
other RI LSA TLV handlers that already guard their subtractions
(e.g., lines 818 and 847 check tlv_length > 12).

Signed-off-by: Tristan <tristan@talencesecurity.com>

Changed files

• print-ospf.c