bgpd: Prevent zero-length BGP-LS MT-ID TLV

[cscarpitta]

An attacker can craft a BGP-LS update containing an MT-ID TLV with zero length (tlv_len == 0). This passes existing validation (0 % 2 == 0 and 0 <= MAX), causing XCALLOC(MTYPE_BGP_LS_NLRI, 0) to be called. This results in unexpected behavior.

This fix validates tlv_len > 0 before allocation in both link and prefix descriptor MT-ID TLV decoder, savoiding unexpected behavior from zero-length inputs and ensuring only valid TLVs are accepted.

[greptile-apps]

Greptile Summary

This PR adds a tlv_len == 0 guard in both bgp_ls_decode_link_descriptor and bgp_ls_decode_prefix_descriptor to reject crafted BGP-LS MT-ID TLVs with zero-length before XCALLOC(MTYPE_BGP_LS_NLRI, 0) can be reached. The fix is minimal, symmetric across both affected decoders, and correctly closes the validation gap that allowed 0 % 2 == 0 to pass the existing length check.

Confidence Score: 5/5

Safe to merge — minimal, correct security fix with no functional regressions.

The two-line change is strictly additive to the validation chain and only adds an early reject for an unambiguously invalid input. Both call sites were identified and patched symmetrically. No other XCALLOC paths driven by tlv_len exist in the file, so coverage is complete. No P0/P1 findings remain.

No files require special attention.

Important Files Changed

Filename	Overview
bgpd/bgp_ls_nlri.c	Adds tlv_len == 0 rejection before XCALLOC in both link and prefix descriptor MT-ID TLV decoders; fix is correct and complete — no other XCALLOC-from-tlv_len paths exist in the file.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Receive BGP-LS Update] --> B[Parse TLV header\ntlv_type, tlv_len]
    B --> C{tlv_type == BGP_LS_TLV_MT_ID?}
    C -- No --> D[Handle other TLVs]
    C -- Yes --> E{tlv_len == 0?}
    E -- Yes --> F[flog_warn: Invalid MT-ID TLV length\ngoto error]
    E -- No --> G{tlv_len % 2 != 0?}
    G -- Yes --> F
    G -- No --> H{tlv_len > BGP_LS_MAX_MT_ID * 2?}
    H -- Yes --> F
    H -- No --> I[mt_id_count = tlv_len / 2\nXCALLOC with tlv_len > 0]
    I --> J[Read mt_id_count MT-IDs from stream]
    J --> K[Set TLV present bit]

Loading

_{Reviews (1): Last reviewed commit: "bgpd: Prevent zero-length BGP-LS MT-ID T..." | Re-trigger Greptile}

[cscarpitta]

ci:rerun