ripd: fix data-handling in several places

[mjstapp]

Use data structs correctly in a couple of places; avoid offering a raw pointer from a packet to '%s'.

[greptile-apps]

Greptile Summary

This PR fixes two distinct data-handling bugs in ripd/ripd.c: (1) a packet pointer being passed directly to %s in zlog_debug without null-termination guarantee (potential buffer over-read), and (2) a type confusion bug where a rip_info_list_head * list pointer was used as if it were a rip_info * struct pointer, leading to incorrect field accesses and potential crashes.

• Auth string safety (rip_packet_dump): the raw uint8_t *p pointing into the packet was passed to %s with no null-terminator. The fix copies exactly RIP_AUTH_SIMPLE_SIZE (16) bytes into a zeroed cbuf[RIP_RTE_SIZE] (20 bytes), guaranteeing null-termination before formatting.
• List-vs-pointer type confusion (rip_response_process): rn->info holds a struct rip_info_list_head * (a DLIST head), but the old code stored it directly into a struct rip_info *rinfo and then accessed rinfo->type. The fix correctly calls rip_info_list_first(rn->info) to obtain the first list element, adds a NULL guard before the pointer is initialized, and adds a NULL check before dereferencing rinfo.
• Both fixes are correct and do not introduce regressions.

Confidence Score: 5/5

• This PR is safe to merge — both changes are targeted, well-reasoned bug fixes with no risk of regression.
• The two changes fix clearly identified bugs (potential buffer over-read and type confusion/NULL dereference). The auth string fix copies exactly the correct number of bytes into a zeroed buffer, ensuring null-termination. The rip_info fix initializes the pointer to NULL, uses the correct list accessor, and guards all dereferences. No new logic is introduced and no other code paths are affected.
• No files require special attention.

Important Files Changed

Filename	Overview
ripd/ripd.c	Fixes two bugs: (1) null-termination of auth string before passing to %s, and (2) correct use of rip_info_list_first() instead of treating rn->info list head as a rip_info pointer. Both fixes are correct and well-scoped.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["rip_packet_dump():\nRIPv2 AUTH_SIMPLE_PASSWORD RTE"] --> B["p = &rte->prefix\n(raw packet pointer, 16 bytes, no null term)"]
    B -->|"OLD: pass p directly to %s"| C["⚠️ zlog_debug(..., p)\npotential buffer over-read"]
    B -->|"NEW: copy to local buffer"| D["memset(cbuf, 0, 20)\nmemcpy(cbuf, p, 16)"]
    D --> E["✅ zlog_debug(..., cbuf)\nnull-terminated, safe"]

    F["rip_response_process():\nNexthop not directly reachable"] --> G["rn = route_node_match(rip->table, &p)"]
    G -->|"rn != NULL"| H["rn->info is rip_info_list_head *"]
    H -->|"OLD: rinfo = rn->info\ntype confusion!"| I["⚠️ rinfo->type dereferences list head"]
    H -->|"NEW: rip_info_list_first(rn->info)"| J["rinfo = first rip_info element or NULL"]
    J --> K["✅ if(rinfo && rinfo->type == ...) safe dereference"]

Loading

_{Last reviewed commit: 4fe4861}

[riw777]

looks good