]> git.ipfire.org Git - thirdparty/iproute2.git/commit
ip/ipnexthop: fix unsigned overflow in parse_nh_group_type_res()
authorMaxim Petrov <mmrmaximuzz@gmail.com>
Wed, 17 Nov 2021 19:11:24 +0000 (22:11 +0300)
committerStephen Hemminger <stephen@networkplumber.org>
Thu, 18 Nov 2021 23:01:48 +0000 (15:01 -0800)
commit5f8bb902e14f91161f9ed214d5fc1d813af8ed88
treebac50b99f87a50b2440deafa43c029f54cdfcc84
parent3184de37976c252a217f53953a439012363d8a6f
ip/ipnexthop: fix unsigned overflow in parse_nh_group_type_res()

0UL has type 'unsigned long' which is likely to be 64bit on modern machines. At
the same time, the '{idle,unbalanced}_timer' variables are declared as u32, so
these variables cannot be greater than '~0UL / 100' when 'unsigned long' is 64
bits. In such condition it is still possible to pass the check but get the
overflow later when the timers are multiplied by 100 in 'addattr32'.

Fix the possible overflow by changing '~0UL' to 'UINT32_MAX'.

Fixes: 91676718228b ("nexthop: Add support for resilient nexthop groups")
Signed-off-by: Maxim Petrov <mmrmaximuzz@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
ip/ipnexthop.c