summaryrefslogtreecommitdiffstats
path: root/proto/bgp
diff options
context:
space:
mode:
authorOndrej Zajicek <santiago@crfreenet.org>2010-07-22 15:09:35 +0200
committerOndrej Zajicek <santiago@crfreenet.org>2010-07-22 15:09:35 +0200
commit852b7062e33b9886eb869fac8b9354497c49b126 (patch)
treeacdd88ced9d2e223241be82c063f34a03f0c7ae0 /proto/bgp
parent7873e9828ff7ba7203fd30ffa7d50859d583d4ca (diff)
downloadbird-852b7062e33b9886eb869fac8b9354497c49b126.tar
bird-852b7062e33b9886eb869fac8b9354497c49b126.zip
Fixes a buffer overflow in TX code of IPv6 BGP.
Diffstat (limited to 'proto/bgp')
-rw-r--r--proto/bgp/packets.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 6e23022..ba43cd2 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -219,7 +219,7 @@ bgp_encode_prefixes(struct bgp_proto *p, byte *w, struct bgp_bucket *buck, unsig
ip_addr a;
int bytes;
- while (!EMPTY_LIST(buck->prefixes) && remains >= 5)
+ while (!EMPTY_LIST(buck->prefixes) && remains >= (1+sizeof(ip_addr)))
{
struct bgp_prefix *px = SKIP_BACK(struct bgp_prefix, bucket_node, HEAD(buck->prefixes));
DBG("\tDequeued route %I/%d\n", px->n.prefix, px->n.pxlen);