summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPaul Jakma <paul.jakma@sun.com>2007-09-07 14:24:55 +0000
committerPaul Jakma <paul.jakma@sun.com>2007-09-07 14:24:55 +0000
commitb2ceea18074ab8cca894051a3fbc30c312e3acc6 (patch)
tree3dfc9d1572582ed26cedad37768be9a57a67f5a8
parent882968e0a2fe65db5aff29149c87f6d292a1cd2d (diff)
[bgpd] low-impact DoS: crash on malformed community with debug set
2007-09-07 Paul Jakma <paul.jakma@sun.com> * (general) bgpd can be made crash by remote peers if debug bgp updates is set, due to NULL pointer dereference. Reported by "Mu Security Research Team", <security@musecurity.com>. * bgp_attr.c: (bgp_attr_community) If community length is 0, don't set the community-present attribute bit, just return early. * bgp_debug.c: (community_str,community_com2str) Check com pointer before dereferencing.
-rw-r--r--bgpd/ChangeLog12
-rw-r--r--bgpd/bgp_attr.c5
-rw-r--r--bgpd/bgp_community.c6
3 files changed, 22 insertions, 1 deletions
diff --git a/bgpd/ChangeLog b/bgpd/ChangeLog
index 1cf5515b..7542df78 100644
--- a/bgpd/ChangeLog
+++ b/bgpd/ChangeLog
@@ -1,3 +1,15 @@
+2007-09-07 Paul Jakma <paul.jakma@sun.com>
+
+ * (general) bgpd can be made crash by remote peers if debug
+ bgp updates is set, due to NULL pointer dereference.
+ Reported by "Mu Security Research Team",
+ <security@musecurity.com>.
+ * bgp_attr.c: (bgp_attr_community) If community length is 0,
+ don't set the community-present attribute bit, just return
+ early.
+ * bgp_debug.c: (community_str,community_com2str) Check com
+ pointer before dereferencing.
+
2007-08-27 Paul Jakma <paul.jakma@sun.com>
* bgp_route.c: (bgp_announce_check) Fix bug #398, slight
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index ee17b6d7..9d13ca6e 100644
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -1007,7 +1007,10 @@ bgp_attr_community (struct peer *peer, bgp_size_t length,
struct attr *attr, u_char flag)
{
if (length == 0)
- attr->community = NULL;
+ {
+ attr->community = NULL;
+ return 0;
+ }
else
{
attr->community =
diff --git a/bgpd/bgp_community.c b/bgpd/bgp_community.c
index 07b8cf81..d5e9821b 100644
--- a/bgpd/bgp_community.c
+++ b/bgpd/bgp_community.c
@@ -206,6 +206,9 @@ community_com2str (struct community *com)
u_int16_t as;
u_int16_t val;
+ if (!com)
+ return NULL;
+
/* When communities attribute is empty. */
if (com->size == 0)
{
@@ -377,6 +380,9 @@ community_dup (struct community *com)
char *
community_str (struct community *com)
{
+ if (!com)
+ return NULL;
+
if (! com->str)
com->str = community_com2str (com);
return com->str;