openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-04-29 08:36:22 +00:00
Code Issues Projects Releases Wiki Activity

You can not use ibuf_add_n32 for an signed 32bit type.

Browse Source 
ibuf_add_nXY() and ibuf_add_hXY() pass values as uint64_t so the sign
extension of a negative 32bit value will cause an overflow check to trigger.
The relative metric field can be negative and so this will trigger this
error. Use ibuf_add() instead, which is more what this should use anyway.

Found the hard way by sthen@ who also debugged it.
OK tb@ sthen@
This commit is contained in:
claudio
2026-03-19 15:36:44 +00:00
parent 701ad029ce
commit 3c3ccd7979
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
usr.sbin/bgpd/bgpd_imsg.c
View File

@@ -1,4 +1,4 @@
/* $OpenBSD: bgpd_imsg.c,v 1.3 2026/03/17 15:15:16 claudio Exp $ */
/* $OpenBSD: bgpd_imsg.c,v 1.4 2026/03/19 15:36:44 claudio Exp $ */
/*
* Copyright (c) 2026 Claudio Jeker <claudio@openbsd.org>
*
@@ -59,7 +59,8 @@ imsg_send_filterset(struct imsgbuf *imsgbuf, struct filter_set_head *set)
case ACTION_SET_RELATIVE_LOCALPREF:
case ACTION_SET_RELATIVE_MED:
case ACTION_SET_RELATIVE_WEIGHT:
if (ibuf_add_n32(msg, s->action.relative) == -1)
if (ibuf_add(msg, &s->action.relative,
sizeof(s->action.relative)) == -1)
goto fail;
break;
case ACTION_SET_NEXTHOP:
@@ -112,7 +113,7 @@ ibuf_recv_filterset_count(struct ibuf *ibuf, uint16_t *count)
int
ibuf_recv_one_filterset(struct ibuf *ibuf, struct filter_set *set)
{
uint32_t type, num;
uint32_t type;
memset(set, 0, sizeof(*set));
@@ -137,9 +138,9 @@ ibuf_recv_one_filterset(struct ibuf *ibuf, struct filter_set *set)
case ACTION_SET_RELATIVE_LOCALPREF:
case ACTION_SET_RELATIVE_MED:
case ACTION_SET_RELATIVE_WEIGHT:
if (ibuf_get_n32(ibuf, &num) == -1)
if (ibuf_get(ibuf, &set->action.relative,
sizeof(set->action.relative)) == -1)
return -1;
set->action.relative = num;
break;
case ACTION_SET_NEXTHOP:
if (ibuf_get(ibuf, &set->action.nexthop,