Merge pull request #16213 from opensourcerouting/fix/fqdn_capability_…

…parsing_for_dynamic_capability bgpd: Check if we have really enough data before doing memcpy for FQDN capability
FRRouting · Jun 24, 2024 · ed5628f · ed5628f
2 parents f047430 + b685ab5
commit ed5628f
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
@@ -3438,7 +3438,7 @@ static void bgp_dynamic_capability_fqdn(uint8_t *pnt, int action,
 		}
 
 		len = *data;
-		if (data + len > end) {
+		if (data + len + 1 > end) {
 			zlog_err("%pBP: Received invalid FQDN capability length (host name) %d",
 				 peer, hdr->length);
 			return;
@@ -3469,7 +3469,7 @@ static void bgp_dynamic_capability_fqdn(uint8_t *pnt, int action,
 
 		/* domainname */
 		len = *data;
-		if (data + len > end) {
+		if (data + len + 1 > end) {
 			zlog_err("%pBP: Received invalid FQDN capability length (domain name) %d",
 				 peer, len);
 			return;