bgpd: Do not crash if we receive a next-hop length not as expected for NHC (backport #20367)#20370
Merged
riw777 merged 1 commit intostable/10.5from Jan 6, 2026
Merged
Conversation
…r NHC
Or NHC attribute length is too short.
==4==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x581cb1a0adba bp 0x7fff9d3d7fb0 sp 0x7fff9d3d7f80 T0)
==4==The signal is caused by a READ memory access.
==4==Hint: address points to the zero page.
0 0x581cb1a0adba in bgp_nhc_free /tmp/frr/bgpd/bgp_nhc.c:79:25
1 0x581cb1774f37 in bgp_attr_nhc /tmp/frr/bgpd/bgp_attr.c:3790:3
2 0x581cb1774f37 in bgp_attr_parse /tmp/frr/bgpd/bgp_attr.c:4352:10
3 0x581cb1887316 in bgp_update_receive /tmp/frr/bgpd/bgp_packet.c:2414:20
4 0x581cb1887316 in bgp_process_packet /tmp/frr/bgpd/bgp_packet.c:4089:11
5 0x7874a9b1da3f in event_call /tmp/frr/lib/event.c:2730:2
6 0x7874a9a2cbc7 in frr_run /tmp/frr/lib/libfrr.c:1258:3
7 0x581cb1762033 in main /tmp/frr/bgpd/bgp_main.c:548:2
8 0x7874a938bd8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
9 0x7874a938be3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
10 0x581cb16a3724 in _start (/usr/sbin/bgpd+0x34e724) (BuildId: 26dc7916b6dcfa8cfe8cac8b1205bed10f4bb5bd)
Found-by: Evan Custodio (Amazon)
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 972fff7)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automatic backport of pull request #20367 done by [Mergify](https://mergify.com).