From: Ondrej Filip <feela@trubka.network.cz>
Date: Wed, 13 Apr 2011 11:19:37 +0000 (+0200)
Subject: Fixed bug FICORA #503685.
X-Git-Tag: v1.3.1~2^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d600909da9ef0a4b25052c1bf2de83d4e7628b0e;p=thirdparty%2Fbird.git

Fixed bug FICORA #503685.
---

diff --git a/proto/ospf/packet.c b/proto/ospf/packet.c
index 3cda38450..d156474e7 100644
--- a/proto/ospf/packet.c
+++ b/proto/ospf/packet.c
@@ -312,6 +312,12 @@ ospf_rx_hook(sock *sk, int size)
   }
 
   int osize = ntohs(ps->length);
+  if ((unsigned) osize < sizeof(struct ospf_packet))
+  {
+    log(L_ERR "%s%I - too low value in size field (%u bytes)", mesg, sk->faddr, osize);
+    return 1;
+  }
+
   if ((osize > size) || ((osize % 4) != 0))
   {
     log(L_ERR "%s%I - size field does not match (%d/%d)", mesg, sk->faddr, osize, size);