Skip to content

zebra: fix heap overflow and guard inconsistency in SRv6 nexthop reso…

7212a1e
Select commit
Loading
Failed to load commit list.
Open

zebra: fix SRv6 encap lost during recursive nexthop resolution #21519

zebra: fix heap overflow and guard inconsistency in SRv6 nexthop reso…
7212a1e
Select commit
Loading
Failed to load commit list.
frrbot / frrbot failed Apr 30, 2026 in 20s

Blocking issues found

Blocking issues found

Details

Thanks for your contribution to FRR!

  • One of your commits has a missing or badly formatted Signed-off-by line; we can't accept your contribution until all of your commits have one
  • One of your commits does not have a blank line between the summary and body; this will break git log --oneline
Click for style suggestions

diff --git a/lib/nexthop.c b/lib/nexthop.c
index 0166ea7e7a..61051fda7a 100644
--- a/lib/nexthop.c
+++ b/lib/nexthop.c
@@ -717,11 +717,9 @@ void nexthop_add_srv6_seg6(struct nexthop *nexthop, const struct in6_addr *segs,
 				sizeof(struct seg6_seg_stack) +
 					num_segs * sizeof(struct in6_addr));
 	} else if (num_segs > nexthop->nh_srv6->seg6_segs->num_segs) {
-		nexthop->nh_srv6->seg6_segs =
-			XREALLOC(MTYPE_NH_SRV6,
-				 nexthop->nh_srv6->seg6_segs,
-				 sizeof(struct seg6_seg_stack) +
-					 num_segs * sizeof(struct in6_addr));
+		nexthop->nh_srv6->seg6_segs = XREALLOC(MTYPE_NH_SRV6, nexthop->nh_srv6->seg6_segs,
+						       sizeof(struct seg6_seg_stack) +
+							       num_segs * sizeof(struct in6_addr));
 	}
 
 	nexthop->nh_srv6->seg6_segs->num_segs = num_segs;
diff --git a/zebra/zebra_nhg.c b/zebra/zebra_nhg.c
index 5f886399d1..bfba417e14 100644
--- a/zebra/zebra_nhg.c
+++ b/zebra/zebra_nhg.c
@@ -1965,18 +1965,12 @@ static struct nexthop *nexthop_set_resolved(afi_t afi, const struct nexthop *new
 	 * value takes precedence and replaces the resolver's.
 	 */
 	if (newhop->nh_srv6) {
-		if (newhop->nh_srv6->seg6local_action !=
-		    ZEBRA_SEG6_LOCAL_ACTION_UNSPEC)
-			nexthop_add_srv6_seg6local(resolved_hop,
-						   newhop->nh_srv6
-							   ->seg6local_action,
-						   &newhop->nh_srv6
-							    ->seg6local_ctx);
-		if (newhop->nh_srv6->seg6_segs &&
-		    newhop->nh_srv6->seg6_segs->num_segs &&
+		if (newhop->nh_srv6->seg6local_action != ZEBRA_SEG6_LOCAL_ACTION_UNSPEC)
+			nexthop_add_srv6_seg6local(resolved_hop, newhop->nh_srv6->seg6local_action,
+						   &newhop->nh_srv6->seg6local_ctx);
+		if (newhop->nh_srv6->seg6_segs && newhop->nh_srv6->seg6_segs->num_segs &&
 		    !sid_zero(newhop->nh_srv6->seg6_segs))
-			nexthop_add_srv6_seg6(resolved_hop,
-					      &newhop->nh_srv6->seg6_segs->seg[0],
+			nexthop_add_srv6_seg6(resolved_hop, &newhop->nh_srv6->seg6_segs->seg[0],
 					      newhop->nh_srv6->seg6_segs->num_segs,
 					      newhop->nh_srv6->seg6_segs->encap_behavior);
 	}
@@ -1989,8 +1983,7 @@ static struct nexthop *nexthop_set_resolved(afi_t afi, const struct nexthop *new
 							   ->seg6local_action,
 						   &nexthop->nh_srv6
 							    ->seg6local_ctx);
-		if (nexthop->nh_srv6->seg6_segs &&
-		    nexthop->nh_srv6->seg6_segs->num_segs &&
+		if (nexthop->nh_srv6->seg6_segs && nexthop->nh_srv6->seg6_segs->num_segs &&
 		    !sid_zero(nexthop->nh_srv6->seg6_segs))
 			nexthop_add_srv6_seg6(resolved_hop, &nexthop->nh_srv6->seg6_segs->seg[0],
 					      nexthop->nh_srv6->seg6_segs->num_segs,

To apply the style suggestions:

curl https://gist.githubusercontent.com/polychaeta/5f852089f828840f99f349248e81c6ba/raw/b031c49ebe7f567518d44b68a3a720ad05e61400/style.diff | git apply -

If you are a new contributor to FRR, please see our contributing guidelines.

After making changes, you do not need to create a new PR. You should perform an amend or interactive rebase followed by a force push.