ospfd: validate extended prefix TLV before accessing prefix SID

[mjstapp]

Ensure the extended-prefix TLV contains enough data before accessing a prefix-SID sub-tlv.

[mjstapp]

@Mergifyio backport stable/10.6 stable/10.5

[mergify]

backport stable/10.6 stable/10.5

✅ Backports have been created

Details

• #22219 ospfd: validate extended prefix TLV before accessing prefix SID (backport #22215) has been created for branch stable/10.6
• #22220 ospfd: validate extended prefix TLV before accessing prefix SID (backport #22215) has been created for branch stable/10.5

[greptile-apps]

Greptile Summary

Adds a defensive length check in ospf_te_parse_ext_pref to ensure the extended-prefix TLV body is large enough to hold both the prefix TLV data and a prefix-SID sub-TLV before the code casts and dereferences a pointer into that region.

• Bounds guard added: before computing pref_sid, a new check ensures len >= TLV_HDR_SIZE + EXT_TLV_PREFIX_SIZE + EXT_SUBTLV_PREFIX_SID_SIZE (i.e. ≥ 20 bytes), covering the 4-byte outer TLV header offset, the 8-byte prefix body, and the 12-byte prefix-SID sub-TLV; previously a crafted or malformed LSA with a short body could trigger a heap over-read.
• No functional change when the TLV is well-formed; the new path only fires for unusually short TLVs that would have produced undefined behaviour before.

Confidence Score: 5/5

Safe to merge; the change is a minimal, targeted guard that prevents a heap over-read on malformed LSAs without altering any well-formed code path.

The arithmetic in the new check is correct: the TLV body must be at least 20 bytes to safely reach every field accessed via the pref_sid pointer. All existing checks pass before this new one, and the function's return-on-failure pattern is consistent with the rest of the function.

No files require special attention.

Important Files Changed

Filename	Overview
ospfd/ospf_te.c	Adds a single bounds check before the fixed-offset pointer cast to ext_subtlv_prefix_sid; the arithmetic is correct (TLV_HDR_SIZE=4 + EXT_TLV_PREFIX_SIZE=8 + EXT_SUBTLV_PREFIX_SID_SIZE=8 = 20 bytes minimum body), and the change does not affect any other code path.

_{Reviews (1): Last reviewed commit: "ospfd: validate extended prefix TLV befo..." | Re-trigger Greptile}