diff options
| author | Jason Kölker <jason@koelker.net> | 2016-01-26 05:01:57 +0000 |
|---|---|---|
| committer | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | 2016-01-30 22:19:05 +0900 |
| commit | 73416eacb164236a8ec38d06fdfff1cf613a6dfd (patch) | |
| tree | d117fd1a57405303d2a61e63288224267d41242f | |
| parent | a71c2a9e1b736a35a4a29d9e1d596c29ac022483 (diff) | |
packet/bgp: Gaurd against extra data in the buffer
While attempting to peer with a vendor switch, parsing its
BGPOptParamCapabilityGracefulRestart excepted due to the length of the
identifier tuples not being a multiple of 4 octets.
It appears that this might be common as other implementations also stop
when the buffer is < 4.
Signed-off-by: Jason Kölker <jason@koelker.net>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
| -rw-r--r-- | ryu/lib/packet/bgp.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ryu/lib/packet/bgp.py b/ryu/lib/packet/bgp.py index cad43806..1038b5e3 100644 --- a/ryu/lib/packet/bgp.py +++ b/ryu/lib/packet/bgp.py @@ -1270,7 +1270,7 @@ class BGPOptParamCapabilityGracefulRestart(_OptParamCapability): (restart, ) = struct.unpack_from(cls._CAP_PACK_STR, six.binary_type(buf)) buf = buf[2:] l = [] - while len(buf) > 0: + while len(buf) >= 4: l.append(struct.unpack_from("!HBB", buf)) buf = buf[4:] return {'flags': restart >> 12, 'time': restart & 0xfff, 'tuples': l} |