cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix ospf segfault introduced in 0.99.19, backported from 0.99.20

Browse Source
This commit is contained in:
sthen 2011-10-02 02:01:07 +00:00
parent 143758b5a0
commit 56616ca74e
2 changed files with 48 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/quagga/Makefile
View File

@ -1,8 +1,9 @@
# $OpenBSD: Makefile,v 1.21 2011/09/27 09:45:53 sthen Exp $
# $OpenBSD: Makefile,v 1.22 2011/10/02 02:01:07 sthen Exp $
COMMENT= multi-threaded routing daemon
DISTNAME= quagga-0.99.19
REVISION= 0
SHARED_LIBS= ospf 0.0 \
ospfapiclient 0.0 \
zebra 0.0

46
net/quagga/patches/patch-ospfd_ospf_packet_c Normal file
View File

@ -0,0 +1,46 @@
$OpenBSD: patch-ospfd_ospf_packet_c,v 1.3 2011/10/02 02:01:07 sthen Exp $
from 0.99.20 upstream
--- ospfd/ospf_packet.c.orig Sun Oct 2 02:44:04 2011
+++ ospfd/ospf_packet.c Sun Oct 2 02:50:36 2011
@@ -2455,16 +2455,10 @@ ospf_read (struct thread *thread)
/* associate packet with ospf interface */
oi = ospf_if_lookup_recv_if (ospf, iph->ip_src, ifp);
- /* Verify header fields before any further processing. */
- ret = ospf_verify_header (ibuf, oi, iph, ospfh);
- if (ret < 0)
- {
- if (IS_DEBUG_OSPF_PACKET (0, RECV))
- zlog_debug ("ospf_read[%s]: Header check failed, "
- "dropping.",
- inet_ntoa (iph->ip_src));
- return ret;
- }
+ /* ospf_verify_header() relies on a valid "oi" and thus can be called only
+ after the passive/backbone/other checks below are passed. These checks
+ in turn access the fields of unverified "ospfh" structure for their own
+ purposes and must remain very accurate in doing this. */
/* If incoming interface is passive one, ignore it. */
if (oi && OSPF_IF_PASSIVE_STATUS (oi) == OSPF_IF_PASSIVE)
@@ -2555,6 +2549,18 @@ ospf_read (struct thread *thread)
ospf_if_set_multicast(oi);
return 0;
}
+
+ /* Verify more OSPF header fields. */
+ ret = ospf_verify_header (ibuf, oi, iph, ospfh);
+ if (ret < 0)
+ {
+ if (IS_DEBUG_OSPF_PACKET (0, RECV))
+ zlog_debug ("ospf_read[%s]: Header check failed, "
+ "dropping.",
+ inet_ntoa (iph->ip_src));
+ return ret;
+ }
+
/* Show debug receiving packet. */
if (IS_DEBUG_OSPF_PACKET (ospfh->type - 1, RECV))