From: Ondrej Zajicek <santiago@crfreenet.org>
Date: Mon, 13 Jul 2026 05:19:52 +0000 (+0200)
Subject: BGP: Fix stack buffer overflow in Flowspec NLRI decoder
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3d96db91a9f705419edeeca5502acc5b0264b752;p=thirdparty%2Fbird.git

BGP: Fix stack buffer overflow in Flowspec NLRI decoder

Flowspec NLRI with zero length causes NLRI decoder to read beyond
validated data, which may trigger a stack buffer overflow.

Reported-By: Tobias Klein <tk@trapkit.de>
Target: patch
---

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 7990c8ffe..e4da05a6b 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -2133,7 +2133,7 @@ bgp_decode_nlri_flow4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
     uint pxlen = 0;
 
     /* Decode dst prefix */
-    if (data[0] == FLOW_TYPE_DST_PREFIX)
+    if (dlen && (data[0] == FLOW_TYPE_DST_PREFIX))
     {
       px = flow_read_ip4_part(data);
       pxlen = flow_read_pxlen(data);
@@ -2228,7 +2228,7 @@ bgp_decode_nlri_flow6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
     uint pxlen = 0;
 
     /* Decode dst prefix */
-    if (data[0] == FLOW_TYPE_DST_PREFIX)
+    if (dlen && (data[0] == FLOW_TYPE_DST_PREFIX))
     {
       px = flow_read_ip6_part(data);
       pxlen = flow_read_pxlen(data);