From a90f7e1a9115d5f313d8f93582c14d56718d3f53 Mon Sep 17 00:00:00 2001 From: IlianaXn Date: Tue, 16 Jun 2026 17:02:20 -0500 Subject: [PATCH] Add bounds checking for AS path segment types to prevent out-of-bounds array access --- lib/formats/bgpstream_parsebgp_common.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/formats/bgpstream_parsebgp_common.c b/lib/formats/bgpstream_parsebgp_common.c index 9d279ece..7dc0043f 100644 --- a/lib/formats/bgpstream_parsebgp_common.c +++ b/lib/formats/bgpstream_parsebgp_common.c @@ -130,6 +130,15 @@ static int append_segments_all(bgpstream_as_path_t *bs_path, for (i = 0; i < pbgp_path->segs_cnt; i++) { seg = &pbgp_path->segs[i]; + + // ensure we're not going to wander off the end of as_path_types array + if (seg->type < PARSEBGP_BGP_UPDATE_AS_PATH_SEG_AS_SET || + seg->type > PARSEBGP_BGP_UPDATE_AS_PATH_SEG_CONFED_SET) { + bgpstream_log(BGPSTREAM_LOG_ERR, "Unknown AS Path segment type %d", + seg->type); + return -1; + } + if (bgpstream_as_path_append(bs_path, as_path_types[seg->type], seg->asns, seg->asns_cnt) != 0) { return -1;