BGP: Fix stack buffer overflow in Flowspec NLRI decoder

Flowspec NLRI with zero length causes NLRI decoder to read beyond
validated data, which may trigger a stack buffer overflow.

Reported-By: Tobias Klein <tk@trapkit.de>
Target: patch

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 7990c8ffe952baa8d64205dfe8be04f1ae197600..e4da05a6b373317d0719402802809f633546ae61 100644 (file)
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -2133,7 +2133,7 @@ bgp_decode_nlri_flow4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
     uint pxlen = 0;
 
     /* Decode dst prefix */
-    if (data[0] == FLOW_TYPE_DST_PREFIX)
+    if (dlen && (data[0] == FLOW_TYPE_DST_PREFIX))
     {
       px = flow_read_ip4_part(data);
       pxlen = flow_read_pxlen(data);
@@ -2228,7 +2228,7 @@ bgp_decode_nlri_flow6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
     uint pxlen = 0;
 
     /* Decode dst prefix */
-    if (data[0] == FLOW_TYPE_DST_PREFIX)
+    if (dlen && (data[0] == FLOW_TYPE_DST_PREFIX))
     {
       px = flow_read_ip6_part(data);
       pxlen = flow_read_pxlen(data);