The patch fixes several issues in Flowspec handling, namely:
- Out-of-bounds read during flowspec validation
- Rejection of NLRI for anomalies that MUST be ignored
- Incorrect check of operand lengths
- Broken label component construction
- Broken formatting of IPv6 prefixes with specific offsets
The first issue was reported by multiple people in recent time.
The second issue found by Bronson Yen of Calif.io in collaboration
with Claude and Anthropic Research.