From: Theo Buehler <tb@theobuehler.org>
Subject: Re: bgpd: fix l3vpn error on withdraws
To: tech@openbsd.org
Date: Mon, 28 Oct 2024 11:30:33 +0100

On Mon, Oct 28, 2024 at 11:19:49AM +0100, Claudio Jeker wrote:
> When withdrawing a L3VPN route (AID_VPN_IPv{4,6}) the labelstack is
> actually unused. Right now this triggers a check in pt_fill() that I added
> because of memcpy UB but here both labelstack pointers are never NULL and
> all of this is just wrong. Therefor just remove the checks.

ok tb

>  
> -- 
> :wq Claudio
> 
> Index: rde_prefix.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/bgpd/rde_prefix.c,v
> diff -u -p -r1.52 rde_prefix.c
> --- rde_prefix.c	10 Sep 2024 08:47:51 -0000	1.52
> +++ rde_prefix.c	28 Oct 2024 10:11:32 -0000
> @@ -225,8 +225,6 @@ pt_fill(struct bgpd_addr *prefix, int pr
>  		pte_vpn4.prefixlen = prefixlen;
>  		pte_vpn4.rd = prefix->rd;
>  		pte_vpn4.labellen = prefix->labellen;
> -		if (prefix->labellen == 0)
> -			fatalx("pt_fill: no MPLS label in VPN addr");
>  		memcpy(pte_vpn4.labelstack, prefix->labelstack,
>  		    prefix->labellen);
>  		return ((struct pt_entry *)&pte_vpn4);
> @@ -241,8 +239,6 @@ pt_fill(struct bgpd_addr *prefix, int pr
>  		pte_vpn6.prefixlen = prefixlen;
>  		pte_vpn6.rd = prefix->rd;
>  		pte_vpn6.labellen = prefix->labellen;
> -		if (prefix->labellen == 0)
> -			fatalx("pt_fill: no MPLS label in VPN addr");
>  		memcpy(pte_vpn6.labelstack, prefix->labelstack,
>  		    prefix->labellen);
>  		return ((struct pt_entry *)&pte_vpn6);
>