diff options
| author | FUJITA Tomonori <fujita.tomonori@gmail.com> | 2020-10-21 09:18:22 +0900 |
|---|---|---|
| committer | FUJITA Tomonori <fujita.tomonori@gmail.com> | 2020-10-21 10:39:56 +0900 |
| commit | 0ac9ac9b2561dceb430e96b2a7973a1a05ab61a0 (patch) | |
| tree | 2dce5bdd308fade69121e981df2748698d7e9264 /pkg/packet/bgp/bgp.go | |
| parent | 22d745fcf591c2a14204598cb2b00877c7a9e3c6 (diff) | |
packet: handle malformed prefix len
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Diffstat (limited to 'pkg/packet/bgp/bgp.go')
| -rw-r--r-- | pkg/packet/bgp/bgp.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/pkg/packet/bgp/bgp.go b/pkg/packet/bgp/bgp.go index 0bb399b7..ee4feb09 100644 --- a/pkg/packet/bgp/bgp.go +++ b/pkg/packet/bgp/bgp.go @@ -1185,6 +1185,11 @@ func (r *IPAddrPrefixDefault) decodePrefix(data []byte, bitlen uint8, addrlen ui eSubCode := uint8(BGP_ERROR_SUB_MALFORMED_ATTRIBUTE_LIST) return NewMessageError(eCode, eSubCode, nil, "network bytes is short") } + if bitlen > addrlen*8 { + eCode := uint8(BGP_ERROR_UPDATE_MESSAGE_ERROR) + eSubCode := uint8(BGP_ERROR_SUB_MALFORMED_ATTRIBUTE_LIST) + return NewMessageError(eCode, eSubCode, nil, "network bit length is too long") + } b := make([]byte, addrlen) copy(b, data[:bytelen]) // clear trailing bits in the last byte. rfc doesn't require |