bgpd: improve flowspec NLRI validation

[mjstapp]

Validate flowspec NLRIs more carefully during parsing, especially offsets into the message buffer.

[greptile-apps]

Greptile Overview

Greptile Summary

Enhanced buffer validation in flowspec NLRI parsing functions to prevent out-of-bounds reads. Added three categories of checks:

• Initial buffer size validation before do/while loops in bgp_flowspec_op_decode and bgp_flowspec_bitmask_decode
• Offset boundary checks before dereferencing buffer contents within loops
• Value size validation to ensure computed sizes don't exceed remaining buffer space

These changes address potential security vulnerabilities from malformed BGP flowspec messages.

Confidence Score: 4/5

• Safe to merge - fixes security issues with minimal functional risk
• Adds defensive boundary checks to prevent buffer overruns without changing parsing logic. All new checks properly set error codes and break/return appropriately. Minor deduction due to lack of test coverage visible in the PR.
• No files require special attention - the changes are straightforward security improvements

Important Files Changed

Filename	Overview
bgpd/bgp_flowspec_util.c	Added buffer boundary checks in three parsing functions to prevent out-of-bounds reads when parsing flowspec NLRI data

_{Last reviewed commit: aa0a8cc}

[mjstapp]

@Mergifyio backport dev/10.6 stable/10.5 stable/10.4 stable/10.3 stable/10.2 stable/10.1 stable/10.0

[mergify]

backport dev/10.6 stable/10.5 stable/10.4 stable/10.3 stable/10.2 stable/10.1 stable/10.0

✅ Backports have been created

Details

• #20825 bgpd: improve flowspec NLRI validation (backport #20814) has been created for branch dev/10.6
• #20826 bgpd: improve flowspec NLRI validation (backport #20814) has been created for branch stable/10.5
• #20827 bgpd: improve flowspec NLRI validation (backport #20814) has been created for branch stable/10.4
• #20828 bgpd: improve flowspec NLRI validation (backport #20814) has been created for branch stable/10.3
• #20829 bgpd: improve flowspec NLRI validation (backport #20814) has been created for branch stable/10.2
• #20830 bgpd: improve flowspec NLRI validation (backport #20814) has been created for branch stable/10.1
• #20831 bgpd: improve flowspec NLRI validation (backport #20814) has been created for branch stable/10.0