]> git.proxmox.com Git - mirror_frr.git/commitdiff
isisd: Prevent direct copy of different size prefix'es
authorDonald Sharp <sharpd@nvidia.com>
Sat, 7 May 2022 01:24:56 +0000 (21:24 -0400)
committerDonald Sharp <sharpd@nvidia.com>
Sat, 7 May 2022 01:24:56 +0000 (21:24 -0400)
Memory is allocated for a `struct prefix_ipv6` but
it was directly copied into a `struct prefix` via
direct pointer copy, which leads to a read past
end of memory.  Fix by using prefix_copy

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
isisd/isis_te.c

index 924922339c13128dedc17d2ca88ca296f3f3ac58..579ae6aabaf9324c83b740041ca42ade042d73f6 100644 (file)
@@ -909,7 +909,7 @@ static int lsp_to_subnet_cb(const struct prefix *prefix, uint32_t metric,
                        p.u.prefix6 = std->local6;
        }
        if (!std)
-               p = *prefix;
+               prefix_copy(&p, prefix);
        else
                te_debug("   |- Adjust prefix %pFX with local address to: %pFX",
                         prefix, &p);