bgpd: Flowspec overflow issue

According to the flowspec RFC 8955 a flowspec nlri is <length, <nlri data>> Specifying 0 as a length makes BGP get all warm on the inside. Which in this case is not a good thing at all. Prevent warmth, stay cold on the inside. Reported-by: Iggy Frankovic <[email protected]> Signed-off-by: Donald Sharp <[email protected]> (cherry picked from commit 0b999c8)
FRRouting · Feb 24, 2023 · 2fa384a · 2fa384a
1 parent 0810529
commit 2fa384a
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/bgpd/bgp_flowspec.c b/bgpd/bgp_flowspec.c
@@ -141,6 +141,13 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
 				psize);
 			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 		}
+
+		if (psize == 0) {
+			flog_err(EC_BGP_FLOWSPEC_PACKET,
+				 "Flowspec NLRI length 0 which makes no sense");
+			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
+		}
+
 		if (bgp_fs_nlri_validate(pnt, psize, afi) < 0) {
 			flog_err(
 				EC_BGP_FLOWSPEC_PACKET,