diff options
| author | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | 2016-04-05 22:25:51 +0900 |
|---|---|---|
| committer | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | 2016-04-05 22:25:51 +0900 |
| commit | 4f000d78206a3ea926e616d6ea2b50f5d8b2e04c (patch) | |
| tree | b7a6e0abf65af9a7621f9a4dcd6402b38c19ad75 /packet | |
| parent | f6c909b6191012a88c499856b47272d826eba227 (diff) | |
packet: handle malformed option param length in OpenMessage
Fixes a possible crash in BGPOpen's DecodeFromBytes().
fixes #818
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Diffstat (limited to 'packet')
| -rw-r--r-- | packet/bgp/bgp.go | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/packet/bgp/bgp.go b/packet/bgp/bgp.go index b7ee98cb..2de2af63 100644 --- a/packet/bgp/bgp.go +++ b/packet/bgp/bgp.go @@ -666,6 +666,9 @@ func (msg *BGPOpen) DecodeFromBytes(data []byte) error { for rest := msg.OptParamLen; rest > 0; { paramtype := data[0] paramlen := data[1] + if rest < paramlen+2 { + return fmt.Errorf("Malformed BGP Open message") + } rest -= paramlen + 2 if paramtype == BGP_OPT_CAPABILITY { |