)]}'
{
  "commit": "a3bc7e9400b214a0f078fdb19596ba54214a1442",
  "tree": "5268048e32b24b2bac3c8a55f41ef25a0b15ff91",
  "parents": [
    "eae18d16fefed42af33e63e096a2889b9c70b9cb"
  ],
  "author": {
    "name": "Donald Sharp",
    "email": "sharpd@cumulusnetworks.com",
    "time": "Wed Jan 27 16:54:45 2016 +0000"
  },
  "committer": {
    "name": "Paul Jakma",
    "email": "paul.jakma@hpe.com",
    "time": "Wed Feb 10 15:02:07 2016 +0000"
  },
  "message": "bgpd: Fix VU#270232, VPNv4 NLRI parser memcpys to stack on unchecked length\n\nAddress CERT vulnerability report VU#270232, memcpy to stack data structure\nbased on length field from packet data whose length field upper-bound was\nnot properly checked.\n\nThis likely allows BGP peers that are enabled to send Labeled-VPN SAFI\nroutes to Quagga bgpd to remotely exploit Quagga bgpd.\n\nMitigation: Do not enable Labeled-VPN SAFI with untrusted neighbours.\n\nImpact: Labeled-VPN SAFI is not enabled by default.\n\n* bgp_mplsvpn.c: (bgp_nlri_parse_vpnv4) The prefixlen is checked for\n  lower-bound, but not for upper-bound against received data length.\n  The packet data is then memcpy\u0027d to the stack based on the prefixlen.\n\n  Extend the prefixlen check to ensure it is within the bound of the NLRI\n  packet data AND the on-stack prefix structure AND the maximum size for the\n  address family.\n\nReported-by: Kostya Kortchinsky \u003ckostyak@google.com\u003e\n\nThis commit a joint effort between:\n\nLou Berger \u003clberger@labn.net\u003e\nDonald Sharp \u003csharpd@cumulusnetworks.com\u003e\nPaul Jakma \u003cpaul.jakma@hpe.com\u003e / \u003cpaul@jakma.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a72d5edeb125156820a62721fbba4c631ba232c1",
      "old_mode": 33188,
      "old_path": "bgpd/bgp_mplsvpn.c",
      "new_id": "75c90cd776a7bc2c1ae996d2a174fa15e822272b",
      "new_mode": 33188,
      "new_path": "bgpd/bgp_mplsvpn.c"
    }
  ]
}