<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div dir="auto" style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div dir="auto" style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div dir="auto" style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi,<div><br></div><div>I am doing testing work on network protocols and here is one possible issue I noticed in OSPF.</div><div><br></div><div>I noticed that you have checked the length of lsa in your function<b> ospf_dump_lsupd</b> in <a href="https://gitlab.nic.cz/labs/bird/-/blob/master/proto/ospf/lsupd.c" aria-current="page" class="router-link-exact-active router-link-active" style="caret-color: rgb(51, 50, 56); font-size: 14px; box-sizing: border-box; font-variant-ligatures: none; color: rgb(51, 50, 56); text-decoration: none; transition: background-color 100ms linear 0s, color 100ms linear 0s, border 100ms linear 0s; display: inline !important;">lsupd.c</a>:</div><div><br></div><div><span> if (((lsa_len % 4) != 0) || (lsa_len <= sizeof(struct ospf_lsa_header)))</span><pre class="code highlight" lang="c"><font face="Helvetica"><span> goto invalid;</span></font></pre><pre class="code highlight" lang="c"><font face="Helvetica"><span>However in the other packet types, like </span>LSACK and LSREQ, I didn’t see similar checking. I am worrying about whether this would be an issue.</font></pre><pre class="code highlight" lang="c"><span style="white-space: normal; font-family: Helvetica;">I would really appreciate it if anyone can have a look at it. Thank you!</span></pre><pre class="code highlight" lang="c"><span style="white-space: normal; font-family: Helvetica;"><br></span></pre><pre class="code highlight" lang="c"><span style="white-space: normal; font-family: Helvetica;">Best</span></pre><pre class="code highlight" lang="c"><span style="white-space: normal; font-family: Helvetica;">Mingwei</span></pre><div></div><div></div></div></div></div></div></body></html>