s = format (s, "%s(%d): ", h->name, t->t);
- for (i = 0; i < (t->l - sizeof (*t)); i++)
- vec_add1 (s, t->v[i]);
+ if (t->l >= 4)
+ {
+ for (i = 0; i < (t->l - sizeof (*t)); i++)
+ vec_add1 (s, t->v[i]);
+ }
vec_add1 (s, '\n');
return s;
tlv->l = ntohs (tlv->l);
/* tlv length includes t, l and v */
+
+ if (tlv->l < 4)
+ return CDP_ERROR_BAD_TLV;
+
cur += tlv->l;
if ((cur - 1) > end)
return CDP_ERROR_BAD_TLV;
+
/*
* Only process known TLVs. In practice, certain
* devices send tlv->t = 0xFF, perhaps as an EOF of sorts.
if (p == 0)
{
pool_get (cm->neighbors, n);
- memset (n, 0, sizeof (*n));
+ clib_memset (n, 0, sizeof (*n));
n->sw_if_index = vnet_buffer (b0)->sw_if_index[VLIB_RX];
n->packet_template_index = (u8) ~ 0;
hash_set (cm->neighbor_by_sw_if_index, n->sw_if_index,