[src/trunk]: src/sys/net/lagg Added length check for safety

[yamaguchi <yamaguchi%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/931acfb00cdb
branches:  trunk
changeset: 364596:931acfb00cdb
user:      yamaguchi <yamaguchi%NetBSD.org@localhost>
date:      Thu Mar 31 01:59:05 2022 +0000

description:
Added length check for safety

pointed out by k-goda@IIJ

diffstat:

 sys/net/lagg/if_lagg_lacp.c |  7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diffs (28 lines):

diff -r 60839d77fd5e -r 931acfb00cdb sys/net/lagg/if_lagg_lacp.c
--- a/sys/net/lagg/if_lagg_lacp.c       Thu Mar 31 01:57:13 2022 +0000
+++ b/sys/net/lagg/if_lagg_lacp.c       Thu Mar 31 01:59:05 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_lagg_lacp.c,v 1.15 2022/03/31 01:40:34 yamaguchi Exp $      */
+/*     $NetBSD: if_lagg_lacp.c,v 1.16 2022/03/31 01:59:05 yamaguchi Exp $      */
 
 /*-
  * SPDX-License-Identifier: BSD-2-Clause-NetBSD
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_lagg_lacp.c,v 1.15 2022/03/31 01:40:34 yamaguchi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_lagg_lacp.c,v 1.16 2022/03/31 01:59:05 yamaguchi Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_lagg.h"
@@ -430,6 +430,9 @@
                if (th->tlv_type == TLV_TYPE_TERMINATE)
                        break;
 
+               if (th->tlv_length <= 0)
+                       break;
+
                for (i = 0; list[i].tlv_t != TLV_TYPE_TERMINATE; i++) {
                        if (th->tlv_type != list[i].tlv_t)
                                continue;