Merge pull request #13864 from pguibert6WIND/bgp_coverity_fix

Bgp coverity fix
FRRouting · Jun 29, 2023 · 1ce1c53 · 1ce1c53
2 parents 6ca6ae3 + bf11a19
commit 1ce1c53
Showing 1 changed file with 20 additions and 15 deletions.
diff --git a/bgpd/bgp_mplsvpn.c b/bgpd/bgp_mplsvpn.c
@@ -4023,14 +4023,21 @@ static void bgp_mplsvpn_nh_label_bind_send_nexthop_label(
 		}
 		p = &pfx_nh;
 		if (nh->nh_label) {
-			if (nh->nh_label->num_labels >
-			    MPLS_MAX_LABELS - num_labels)
-				lsp_num_labels = MPLS_MAX_LABELS - num_labels;
-			else
-				lsp_num_labels = nh->nh_label->num_labels;
+			if (nh->nh_label->num_labels + 1 > MPLS_MAX_LABELS) {
+				/* label stack overflow. no label switching will be performed
+				 */
+				flog_err(EC_BGP_LABEL,
+					 "%s [Error] BGP label %u->%u to %pFX, forged label stack too big: %u. Abort LSP installation",
+					 bmnc->bgp_vpn->name_pretty,
+					 bmnc->new_label, bmnc->orig_label,
+					 &bmnc->nexthop,
+					 nh->nh_label->num_labels + 1);
+				return;
+			}
+			lsp_num_labels = nh->nh_label->num_labels;
 			for (i = 0; i < lsp_num_labels; i++)
 				label[num_labels + i] = nh->nh_label->label[i];
-			num_labels += lsp_num_labels;
+			num_labels = lsp_num_labels;
 		}
 		label[num_labels] = bmnc->orig_label;
 		num_labels += 1;
@@ -4239,15 +4246,13 @@ void bgp_mplsvpn_nh_label_bind_register_local_label(struct bgp *bgp,
 		return;
 
 	bgp_mplsvpn_path_nh_label_bind_unlink(pi);
-	if (bmnc) {
-		/* updates NHT pi list reference */
-		LIST_INSERT_HEAD(&(bmnc->paths), pi,
-				 mplsvpn.bmnc.nh_label_bind_thread);
-		pi->mplsvpn.bmnc.nh_label_bind_cache = bmnc;
-		pi->mplsvpn.bmnc.nh_label_bind_cache->path_count++;
-		SET_FLAG(pi->flags, BGP_PATH_MPLSVPN_NH_LABEL_BIND);
-		bmnc->last_update = monotime(NULL);
-	}
+
+	/* updates NHT pi list reference */
+	LIST_INSERT_HEAD(&(bmnc->paths), pi, mplsvpn.bmnc.nh_label_bind_thread);
+	pi->mplsvpn.bmnc.nh_label_bind_cache = bmnc;
+	pi->mplsvpn.bmnc.nh_label_bind_cache->path_count++;
+	SET_FLAG(pi->flags, BGP_PATH_MPLSVPN_NH_LABEL_BIND);
+	bmnc->last_update = monotime(NULL);
 
 	/* Add or update the selected nexthop */
 	if (!bmnc->nh)