packet: fix FQDN capability parser

Fixes #2708
osrg · Oct 31, 2023 · e26631c · e26631c
1 parent 286c887
commit e26631c
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/pkg/packet/bgp/bgp.go b/pkg/packet/bgp/bgp.go
@@ -1013,10 +1013,26 @@ func (c *CapFQDN) DecodeFromBytes(data []byte) error {
 	if len(data) < 2 {
 		return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "Not all CapabilityFQDN bytes allowed")
 	}
+	rest := len(data)
+	if rest < 1 {
+		return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "Not all CapabilityFQDN bytes allowed")
+	}
 	hostNameLen := uint8(data[0])
+	rest -= 1
 	c.HostNameLen = hostNameLen
+	if rest < int(hostNameLen) {
+		return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "Not all CapabilityFQDN bytes allowed")
+	}
 	c.HostName = string(data[1 : c.HostNameLen+1])
+	rest -= int(hostNameLen)
+	if rest < 1 {
+		return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "Not all CapabilityFQDN bytes allowed")
+	}
+	rest -= 1
 	domainNameLen := uint8(data[c.HostNameLen+1])
+	if rest < int(domainNameLen) {
+		return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "Not all CapabilityFQDN bytes allowed")
+	}
 	c.DomainNameLen = domainNameLen
 	c.DomainName = string(data[c.HostNameLen+2:])
 	return nil