From: Ondrej Zajicek (work) <santiago@crfreenet.org>
Date: Wed, 10 Jun 2020 11:27:14 +0000 (+0200)
Subject: OSPF: Fix bad header length test
X-Git-Tag: v2.0.8~59
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=82937b465b3a50bdcb00eff0b7aa6acb3fc21772;p=thirdparty%2Fbird.git

OSPF: Fix bad header length test

Thanks to Slava Aseev for the thorough bugreport.
---

diff --git a/proto/ospf/packet.c b/proto/ospf/packet.c
index 599f3094e..cbc8f2ec8 100644
--- a/proto/ospf/packet.c
+++ b/proto/ospf/packet.c
@@ -441,7 +441,8 @@ ospf_rx_hook(sock *sk, uint len)
     DROP("version mismatch", pkt->version);
 
   uint plen = ntohs(pkt->length);
-  if ((plen < sizeof(struct ospf_packet)) || ((plen % 4) != 0))
+  uint hlen = sizeof(struct ospf_packet) + (ospf_is_v2(p) ? sizeof(union ospf_auth2) : 0);
+  if ((plen < hlen) || ((plen % 4) != 0))
     DROP("invalid length", plen);
 
   if (sk->flags & SKF_TRUNCATED)
@@ -462,9 +463,8 @@ ospf_rx_hook(sock *sk, uint len)
 
   if (ospf_is_v2(p) && (pkt->autype != OSPF_AUTH_CRYPT))
   {
-    uint hlen = sizeof(struct ospf_packet) + sizeof(union ospf_auth2);
-    uint blen = plen - hlen;
     void *body = ((void *) pkt) + hlen;
+    uint blen = plen - hlen;
 
     if (!ipsum_verify(pkt, sizeof(struct ospf_packet), body, blen, NULL))
       DROP("invalid checksum", ntohs(pkt->checksum));