diff options
Diffstat (limited to 'scripts/package-build')
| -rw-r--r-- | scripts/package-build/frr/patches/frr/0009-T7909-eigrp-malformed-update-fix.patch | 101 |
1 files changed, 101 insertions, 0 deletions
diff --git a/scripts/package-build/frr/patches/frr/0009-T7909-eigrp-malformed-update-fix.patch b/scripts/package-build/frr/patches/frr/0009-T7909-eigrp-malformed-update-fix.patch new file mode 100644 index 00000000..8aaa2c16 --- /dev/null +++ b/scripts/package-build/frr/patches/frr/0009-T7909-eigrp-malformed-update-fix.patch @@ -0,0 +1,101 @@ +From d5777f8c38a9c61d8992d6ede9a6ea9697fd5ba0 Mon Sep 17 00:00:00 2001 +From: Ritika Chopra <ritika0313@gmail.com> +Date: Sun, 5 Oct 2025 21:41:46 -0700 +Subject: [PATCH] eigrpd: Handling for malformed update packets + +-EIGRP daemon was crashing when the code was attempting to read more data from EIGRP update malformed packets than is available in the packets stream. +-Safety checks have been added before reading from the stream to prevent any crashes +-This patch addresses the Update packets carrying routes other than IPv4 Internal routes + +Signed-off-by: Ritika Chopra <ritika0313@gmail.com> +--- + eigrpd/eigrp_packet.c | 6 ++++++ + eigrpd/eigrp_update.c | 46 ++++++++++++++++++++++++++++++++++++++++--- + 2 files changed, 49 insertions(+), 3 deletions(-) + +diff --git a/eigrpd/eigrp_packet.c b/eigrpd/eigrp_packet.c +index e930e8f3c1..f4c16efca5 100644 +--- a/eigrpd/eigrp_packet.c ++++ b/eigrpd/eigrp_packet.c +@@ -551,6 +551,12 @@ void eigrp_read(struct event *thread) + /* Advance from IP header to EIGRP header (iph->ip_hl has been verified + by eigrp_recv_packet() to be correct). */ + ++ if ((iph->ip_hl * 4) + EIGRP_HEADER_LEN > stream_get_endp(ibuf)) { ++ zlog_warn("Malformed packet: IP header extends beyond packet data. IP header len = %u endp = %zu", ++ iph->ip_hl * 4, stream_get_endp(ibuf)); ++ return; ++ } ++ + stream_forward_getp(ibuf, (iph->ip_hl * 4)); + eigrph = (struct eigrp_header *)stream_pnt(ibuf); + +diff --git a/eigrpd/eigrp_update.c b/eigrpd/eigrp_update.c +index 7348231c3b..df03ee2d90 100644 +--- a/eigrpd/eigrp_update.c ++++ b/eigrpd/eigrp_update.c +@@ -279,6 +279,13 @@ void eigrp_update_receive(struct eigrp *eigrp, struct ip *iph, + + /*If there is topology information*/ + while (s->endp > s->getp) { ++ /* Ensure we have at least 4 bytes for TLV header */ ++ if (STREAM_READABLE(s) < 4) { ++ zlog_warn("Malformed packet: Unexpected early end of packet reached, stopping TLV processing"); ++ stream_forward_getp(s, STREAM_READABLE(s)); ++ break; ++ } ++ + type = stream_getw(s); + switch (type) { + case EIGRP_TLV_IPv4_INT: +@@ -369,11 +376,44 @@ void eigrp_update_receive(struct eigrp *eigrp, struct ip *iph, + * for now, lets just not creash the box + */ + default: ++ /* Handle unknown TLV types gracefully */ ++ zlog_warn("Unknown TLV type: 0x%04x", type); ++ ++ /* Validate we have enough data for TLV length */ ++ if (STREAM_READABLE(s) < 2) { ++ zlog_warn("Malformed packet: insufficient data for TLV length, skipping to end"); ++ stream_forward_getp(s, STREAM_READABLE(s)); ++ break; ++ } ++ + length = stream_getw(s); +- // -2 for type, -2 for len +- for (length -= 4; length; length--) { +- (void)stream_getc(s); ++ ++ /* Validate TLV length */ ++ if (length < 4) { ++ zlog_warn("Malformed packet: TLV length too small (%u), skipping to end", length); ++ stream_forward_getp(s, STREAM_READABLE(s)); ++ break; + } ++ ++ /* Check for reasonable TLV length */ ++ if (length > 1024) { ++ zlog_warn("Malformed packet: TLV length too large (%u), skipping to end", length); ++ stream_forward_getp(s, STREAM_READABLE(s)); ++ break; ++ } ++ ++ /* Check if TLV extends beyond packet */ ++ if (length > STREAM_READABLE(s) + 4) { ++ zlog_warn("Malformed packet: TLV length (%u) exceeds remaining data (%zu) + 4, skipping to end", ++ length, STREAM_READABLE(s)); ++ break; ++ } ++ /* Skip current TLV data safely to move on to next TLV */ ++ if (IS_DEBUG_EIGRP_PACKET(0, RECV)) ++ zlog_debug("Skipping unknown TLV: type=0x%04x, length=%u", type, length); ++ stream_forward_getp(s, length - 4); ++ ++ + } + } + +-- +2.47.3 + |