packet/bgp: Gaurd against extra data in the buffer

While attempting to peer with a vendor switch, parsing its
BGPOptParamCapabilityGracefulRestart excepted due to the length of the
identifier tuples not being a multiple of 4 octets.

It appears that this might be common as other implementations also stop
when the buffer is < 4.

Signed-off-by: Jason Kölker <jason@koelker.net>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
This commit is contained in:
Jason Kölker 2016-01-26 05:01:57 +00:00 committed by FUJITA Tomonori
parent a71c2a9e1b
commit 73416eacb1

View File

@ -1270,7 +1270,7 @@ class BGPOptParamCapabilityGracefulRestart(_OptParamCapability):
(restart, ) = struct.unpack_from(cls._CAP_PACK_STR, six.binary_type(buf))
buf = buf[2:]
l = []
while len(buf) > 0:
while len(buf) >= 4:
l.append(struct.unpack_from("!HBB", buf))
buf = buf[4:]
return {'flags': restart >> 12, 'time': restart & 0xfff, 'tuples': l}