diff options
| author | Donald Sharp <sharpd@nvidia.com> | 2022-05-07 03:24:56 +0200 |
|---|---|---|
| committer | Donald Sharp <sharpd@nvidia.com> | 2022-05-07 03:24:56 +0200 |
| commit | 14678bfa0d1c6cbf4346085676b1458461a0faaf (patch) | |
| tree | 5d25a7d9698a7ca36c2439ea449aaecd1c60f16a /isisd | |
| parent | isisd: Remove unneeded pre-declarations (diff) | |
| download | frr-14678bfa0d1c6cbf4346085676b1458461a0faaf.tar.xz frr-14678bfa0d1c6cbf4346085676b1458461a0faaf.zip | |
isisd: Prevent direct copy of different size prefix'es
Memory is allocated for a `struct prefix_ipv6` but
it was directly copied into a `struct prefix` via
direct pointer copy, which leads to a read past
end of memory. Fix by using prefix_copy
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
Diffstat (limited to 'isisd')
| -rw-r--r-- | isisd/isis_te.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/isisd/isis_te.c b/isisd/isis_te.c index 924922339..579ae6aab 100644 --- a/isisd/isis_te.c +++ b/isisd/isis_te.c @@ -909,7 +909,7 @@ static int lsp_to_subnet_cb(const struct prefix *prefix, uint32_t metric, p.u.prefix6 = std->local6; } if (!std) - p = *prefix; + prefix_copy(&p, prefix); else te_debug(" |- Adjust prefix %pFX with local address to: %pFX", prefix, &p); |