commit | a225ce337dfbbd8f52043827b792d869e8a306e7 | [log] [tgz] |
---|---|---|
author | Guy Harris <gharris@sonic.net> | Tue May 26 22:14:24 2020 -0700 |
committer | Guy Harris <gharris@sonic.net> | Tue May 26 22:14:24 2020 -0700 |
tree | e6990a7e98635135b0ccdc27b68696be63cbac0a | |
parent | 3cb1082cb5ca0701728c5be20f691f59804f8c29 [diff] |
isis: add some additional length checks. Make sure the length in question is big enough before fetching data and subtracting from it.
diff --git a/print-isoclns.c b/print-isoclns.c index b5943cc..3859c8f 100644 --- a/print-isoclns.c +++ b/print-isoclns.c
@@ -1921,10 +1921,14 @@ algo = GET_U_1(tptr+1); if (flags & ISIS_PREFIX_SID_FLAG_V) { + if (subl < 5) + goto trunc; sid = GET_BE_U_3(tptr+2); tptr+=5; subl-=5; } else { + if (subl < 6) + goto trunc; sid = GET_BE_U_4(tptr+2); tptr+=6; subl-=6;