bgpd: add a NULL check to prevent a crash in the rfapi code

[mirror_frr.git] / bgpd / bgp_updgrp_packet.c

diff --git a/bgpd/bgp_updgrp_packet.c b/bgpd/bgp_updgrp_packet.c
index 1d50cb1ca1e1504565eb2a43ec9c80bfbe773279..c0761503f13c8ada0651449dca2aba483d8d68e6 100644 (file)
--- a/bgpd/bgp_updgrp_packet.c
+++ b/bgpd/bgp_updgrp_packet.c
@@ -46,6 +46,7 @@
 
 #include "bgpd/bgpd.h"
 #include "bgpd/bgp_debug.h"
+#include "bgpd/bgp_errors.h"
 #include "bgpd/bgp_fsm.h"
 #include "bgpd/bgp_route.h"
 #include "bgpd/bgp_packet.h"
@@ -396,8 +397,8 @@ struct stream *bpacket_reformat_for_peer(struct bpacket *pkt,
 
        vec = &pkt->arr.entries[BGP_ATTR_VEC_NH];
        if (CHECK_FLAG(vec->flags, BPKT_ATTRVEC_FLAGS_UPDATED)) {
-               u_int8_t nhlen;
-               afi_t nhafi = AFI_MAX; /* NH AFI is based on nhlen! */
+               uint8_t nhlen;
+               afi_t nhafi;
                int route_map_sets_nh;
                nhlen = stream_getc_from(s, vec->offset);
                if (peer_cap_enhe(peer, paf->afi, paf->safi))
@@ -467,13 +468,12 @@ struct stream *bpacket_reformat_for_peer(struct bpacket *pkt,
                                nh_modified = 1;
                        } else if (
                                peer->sort == BGP_PEER_EBGP
-                               && paf->safi != SAFI_EVPN
                                && (bgp_multiaccess_check_v4(v4nh, peer) == 0)
                                && !CHECK_FLAG(
                                           vec->flags,
                                           BPKT_ATTRVEC_FLAGS_RMAP_NH_UNCHANGED)
                                && !peer_af_flag_check(
-                                          peer, nhafi, paf->safi,
+                                          peer, paf->afi, paf->safi,
                                           PEER_FLAG_NEXTHOP_UNCHANGED)) {
                                /* NOTE: not handling case where NH has new AFI
                                 */
@@ -699,10 +699,10 @@ struct bpacket *subgroup_update_packet(struct update_subgroup *subgrp)
        int num_pfx = 0;
        int addpath_encode = 0;
        int addpath_overhead = 0;
-       u_int32_t addpath_tx_id = 0;
+       uint32_t addpath_tx_id = 0;
        struct prefix_rd *prd = NULL;
        mpls_label_t label = MPLS_INVALID_LABEL, *label_pnt = NULL;
-       u_int32_t num_labels = 0;
+       uint32_t num_labels = 0;
 
        if (!subgrp)
                return NULL;
@@ -787,7 +787,8 @@ struct bpacket *subgroup_update_packet(struct update_subgroup *subgrp)
                         * NLRI then
                         * return */
                        if (space_remaining < space_needed) {
-                               zlog_err(
+                               flog_err(
+                                       BGP_ERR_UPDGRP_ATTR_LEN,
                                        "u%" PRIu64 ":s%" PRIu64
                                        " attributes too long, cannot send UPDATE",
                                        subgrp->update_group->id, subgrp->id);
@@ -937,7 +938,7 @@ struct bpacket *subgroup_withdraw_packet(struct update_subgroup *subgrp)
        size_t mp_start = 0;
        size_t attrlen_pos = 0;
        size_t mplen_pos = 0;
-       u_char first_time = 1;
+       uint8_t first_time = 1;
        afi_t afi;
        safi_t safi;
        int space_remaining = 0;
@@ -945,7 +946,7 @@ struct bpacket *subgroup_withdraw_packet(struct update_subgroup *subgrp)
        int num_pfx = 0;
        int addpath_encode = 0;
        int addpath_overhead = 0;
-       u_int32_t addpath_tx_id = 0;
+       uint32_t addpath_tx_id = 0;
        struct prefix_rd *prd = NULL;