From d2dda70be42402e0d456e1ead4035e196253f77f Mon Sep 17 00:00:00 2001
From: Olivier Dugeon <olivier.dugeon@orange.com>
Date: Mon, 26 Feb 2024 10:40:34 +0100
Subject: [PATCH] ospfd: Solved crash in OSPF TE parsing

Iggy Frankovic discovered an ospfd crash when perfomring fuzzing of OSPF LSA
packets. The crash occurs in ospf_te_parse_te() function when attemping to
create corresponding egde from TE Link parameters. If there is no local
address, an edge is created but without any attributes. During parsing, the
function try to access to this attribute fields which has not been created
causing an ospfd crash.

The patch simply check if the te parser has found a valid local address. If not
found, we stop the parser which avoid the crash.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>

CVE: CVE-2024-27913
Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/a73e66d07329d721f26f3f336f7735de420b0183]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
---
 ospfd/ospf_te.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index 999bc49d9..5af006e54 100644
--- a/ospfd/ospf_te.c
+++ b/ospfd/ospf_te.c
@@ -2276,6 +2276,10 @@ static int ospf_te_parse_te(struct ls_ted *ted, struct ospf_lsa *lsa)
 	}
 
 	/* Get corresponding Edge from Link State Data Base */
+	if (IPV4_NET0(attr.standard.local.s_addr) && !attr.standard.local_id) {
+		ote_debug("  |- Found no TE Link local address/ID. Abort!");
+		return -1;
+	}
 	edge = get_edge(ted, attr.adv, attr.standard.local);
 	old = edge->attributes;
 
-- 
2.35.5

