summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOndrej Zajicek <santiago@crfreenet.org>2011-04-29 19:03:19 +0200
committerOndrej Zajicek <santiago@crfreenet.org>2011-04-29 19:03:19 +0200
commit5964569c23829ec93fcf671a2582be01c8aebecf (patch)
tree0f4b37d99144b748494c2a0caae2533891ea9768
parentacc93efd4c754cc995ee8edf52ce0bc45511062e (diff)
parentd600909da9ef0a4b25052c1bf2de83d4e7628b0e (diff)
downloadbird-5964569c23829ec93fcf671a2582be01c8aebecf.tar
bird-5964569c23829ec93fcf671a2582be01c8aebecf.zip
Merge commit 'origin/master'
-rw-r--r--proto/ospf/packet.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/proto/ospf/packet.c b/proto/ospf/packet.c
index 3cda384..d156474 100644
--- a/proto/ospf/packet.c
+++ b/proto/ospf/packet.c
@@ -312,6 +312,12 @@ ospf_rx_hook(sock *sk, int size)
}
int osize = ntohs(ps->length);
+ if ((unsigned) osize < sizeof(struct ospf_packet))
+ {
+ log(L_ERR "%s%I - too low value in size field (%u bytes)", mesg, sk->faddr, osize);
+ return 1;
+ }
+
if ((osize > size) || ((osize % 4) != 0))
{
log(L_ERR "%s%I - size field does not match (%d/%d)", mesg, sk->faddr, osize, size);