Skip to content

Commit

Permalink
zebra: guard against junk in nexthop->rmap_src
Browse files Browse the repository at this point in the history
rmap_src wasn't initialized, so for IPv4 the unused 12 bytes would
contain whatever junk is on the stack on function entry.  Also move
the IPv4 parse before the IPv6 parse so if it's successful we can be
sure the other bytes haven't been touched.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
  • Loading branch information
eqvinox committed Jan 29, 2025
1 parent c88589f commit b666ee5
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions zebra/zebra_routemap.c
Original file line number Diff line number Diff line change
Expand Up @@ -959,10 +959,11 @@ route_set_src(void *rule, const struct prefix *prefix, void *object)
/* set src compilation. */
static void *route_set_src_compile(const char *arg)
{
union g_addr src, *psrc;
union g_addr src = {}, *psrc;

if ((inet_pton(AF_INET6, arg, &src.ipv6) == 1)
|| (inet_pton(AF_INET, arg, &src.ipv4) == 1)) {
/* IPv4 first, to ensure no garbage in the 12 unused bytes */
if ((inet_pton(AF_INET, arg, &src.ipv4) == 1) ||
(inet_pton(AF_INET6, arg, &src.ipv6) == 1)) {
psrc = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, sizeof(union g_addr));
*psrc = src;
return psrc;
Expand Down

0 comments on commit b666ee5

Please sign in to comment.