]> git.ipfire.org Git - thirdparty/bird.git/commit
Fix several issues in Flowspec handling master oz-test
authorOndrej Zajicek <santiago@crfreenet.org>
Fri, 5 Jun 2026 13:48:46 +0000 (15:48 +0200)
committerOndrej Zajicek <santiago@crfreenet.org>
Fri, 5 Jun 2026 15:31:04 +0000 (17:31 +0200)
commit2f563413ebb17f6282f0f0bb91975e323e0fc451
tree6f4a6a1cfb990306a23f893de0392e16c8b32f32
parent02d082a71257944a6038320b43b0f5d95af19548
Fix several issues in Flowspec handling

The patch fixes several issues in Flowspec handling, namely:

 - Out-of-bounds read during flowspec validation
 - Rejection of NLRI for anomalies that MUST be ignored
 - Incorrect check of operand lengths
 - Broken label component construction
 - Broken formatting of IPv6 prefixes with specific offsets

The first issue was reported by multiple people in recent time.

The second issue found by Bronson Yen of Calif.io in collaboration
with Claude and Anthropic Research.
conf/flowspec.Y
doc/bird.sgml
lib/flowspec.c
lib/flowspec.h
lib/flowspec_test.c
proto/bgp/packets.c