ospfclient: Ensure ospf_apiclient_lsa_originate cannot accidently write into stack

Even though OSPF_MAX_LSA_SIZE is quite large and holds the upper bound
on what can be written into a lsa, let's add a small check to ensure
it is not possible to do a bad thing.

This wins one of the long standing bug awards.  2003!

Fixes: #11602
Signed-off-by: Donald Sharp <sharpd@nvidia.com>

diff --git a/ospfclient/ospf_apiclient.c b/ospfclient/ospf_apiclient.c
index e84c6f5b3c975f51187a812dfd7b75ee9323c049..41f0b25b916c8cac18f476e79036be693f379fb0 100644 (file)
--- a/ospfclient/ospf_apiclient.c
+++ b/ospfclient/ospf_apiclient.c
@@ -447,6 +447,12 @@ int ospf_apiclient_lsa_originate(struct ospf_apiclient *oclient,
                return OSPF_API_ILLEGALLSATYPE;
        }
 
+       if ((size_t)opaquelen > sizeof(buf) - sizeof(struct lsa_header)) {
+               fprintf(stderr, "opaquelen(%d) is larger than buf size %zu\n",
+                       opaquelen, sizeof(buf));
+               return OSPF_API_NOMEMORY;
+       }
+
        /* Make a new LSA from parameters */
        lsah = (struct lsa_header *)buf;
        lsah->ls_age = 0;