vpp icon indicating copy to clipboard operation
vpp copied to clipboard

[VPP-1682] the 'curr_key' and 'next_key' members of struct 'bfd_session_t' could become wild pointer

Open vvalderrv opened this issue 10 months ago • 1 comments

Description

the function 'bfd_auth_set_key' uses 'pool_get' to get a memory address 'auth_key', then in function 'bfd_auth_activate' , the 'auth_key' pointer  is assigned to 'bs->auth.next_key' or 

'bs->auth.curr_key'. However, when uses 'pool_get' to add a new bfd key, '_vec_resize' could change the pool start address, which will makes the 'bs->auth.next_key' or 'bs->auth.curr_key'

becoming unsaved pointer.

Assignee

hu jihui

Reporter

hu jihui

Comments

No comments.

Original issue: https://jira.fd.io/browse/VPP-1682

vvalderrv avatar Feb 02 '25 04:02 vvalderrv