Merge pull request #6160 from qlyoung/fix-pim-bsm-negative-shift

pimd: fix negative bitshift in BSM code
FRRouting · Apr 6, 2020 · 6b1d9f3 · 6b1d9f3
2 parents dc61176 + 817f893
commit 6b1d9f3
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/pimd/pim_bsm.c b/pimd/pim_bsm.c
@@ -1282,6 +1282,13 @@ int pim_bsm_process(struct interface *ifp, struct ip *ip_hdr, uint8_t *buf,
 	bshdr = (struct bsm_hdr *)(buf + PIM_MSG_HEADER_LEN);
 	pim_inet4_dump("<bsr?>", bshdr->bsr_addr.addr, bsr_str,
 		       sizeof(bsr_str));
+	if (bshdr->hm_len > 32) {
+		zlog_warn("Bad hashmask length for IPv4; got %" PRIu8
+			  ", expected value in range 0-32",
+			  bshdr->hm_len);
+		pim->bsm_dropped++;
+		return -1;
+	}
 	pim->global_scope.hashMasklen = bshdr->hm_len;
 	frag_tag = ntohs(bshdr->frag_tag);