T7909: Added handling for malformed update msgs

This patch fixes the crashes happening upon receipt of malformed update packets carrying routes other than IPv4 Internal routes. For packets carrying IPv4 Inernal routes, a subsequent patch is required

Author: ritika0313

scripts/package-build/frr/patches/frr/0009-T7909-eigrp-malformed-update-fix.patch

@@ -0,0 +1,104 @@
+From 530ad90cba0b85ba53f3886a96fd3252eaa2e9c0 Mon Sep 17 00:00:00 2001
+From: Ritika Chopra <ritika0313@gmail.com>
+Date: Sun, 5 Oct 2025 21:41:46 -0700
+Subject: [PATCH] T7909-handle-malformed-update-pkts-non-ipv4-int
+
+Code is trying to read more data than is available in the packet stream, leading to crashes. Handling currently added for pkts other than IPv4-Internal route type
+---
+ eigrpd/eigrp_packet.c |  6 ++++++
+ eigrpd/eigrp_update.c | 46 ++++++++++++++++++++++++++++++++++++++++---
+ 2 files changed, 49 insertions(+), 3 deletions(-)
+
+diff --git a/eigrpd/eigrp_packet.c b/eigrpd/eigrp_packet.c
+index 4daff3201..43a36cd7a 100644
+--- a/eigrpd/eigrp_packet.c
++++ b/eigrpd/eigrp_packet.c
+@@ -548,6 +548,12 @@ void eigrp_read(struct event *thread)
+ 	/* Advance from IP header to EIGRP header (iph->ip_hl has been verified
+ 	   by eigrp_recv_packet() to be correct). */
+ 
++	if((iph->ip_hl * 4) + EIGRP_HEADER_LEN > stream_get_endp(ibuf))
++	{
++		zlog_debug("Malformed packet: IP header extends beyond packet data. IP header len = %u endp = %lu",
++				iph->ip_hl * 4,stream_get_endp(ibuf));
++		return;
++	}
+ 	stream_forward_getp(ibuf, (iph->ip_hl * 4));
+ 	eigrph = (struct eigrp_header *)stream_pnt(ibuf);
+ 
+diff --git a/eigrpd/eigrp_update.c b/eigrpd/eigrp_update.c
+index 7348231c3..5c6d242b9 100644
+--- a/eigrpd/eigrp_update.c
++++ b/eigrpd/eigrp_update.c
+@@ -169,6 +169,7 @@ void eigrp_update_receive(struct eigrp *eigrp, struct ip *iph,
+ 	uint8_t graceful_restart_final;
+ 	struct list *nbr_prefixes = NULL;
+ 
++
+ 	/* increment statistics. */
+ 	ei->update_in++;
+ 
+@@ -279,6 +280,13 @@ void eigrp_update_receive(struct eigrp *eigrp, struct ip *iph,
+ 
+ 	/*If there is topology information*/
+ 	while (s->endp > s->getp) {
++		/* Ensure we have at least 4 bytes for TLV header */
++		if (STREAM_READABLE(s) < 4) {
++			zlog_debug("End of packet reached, stopping TLV processing");
++			stream_forward_getp(s, STREAM_READABLE(s));
++			break;
++		}
++
+ 		type = stream_getw(s);
+ 		switch (type) {
+ 		case EIGRP_TLV_IPv4_INT:
+@@ -369,11 +377,43 @@ void eigrp_update_receive(struct eigrp *eigrp, struct ip *iph,
+ 		 *      for now, lets just not creash the box
+ 		 */
+ 		default:
++			/* Handle unknown TLV types gracefully */
++			zlog_debug("Unknown TLV type: 0x%04x", type);
++
++			/* Validate we have enough data for TLV length */
++			if (STREAM_READABLE(s) < 2) {
++				zlog_warn("Malformed packet: insufficient data for TLV length, skipping to end");
++				stream_forward_getp(s, STREAM_READABLE(s));
++				break;
++			}
++
+ 			length = stream_getw(s);
+-			// -2 for type, -2 for len
+-			for (length -= 4; length; length--) {
+-				(void)stream_getc(s);
++
++			/* Validate TLV length */
++			if (length < 4) {
++				zlog_warn("Malformed packet: TLV length too small (%u), skipping to end", length);
++				stream_forward_getp(s, STREAM_READABLE(s));
++				break;
+ 			}
++
++                        /* Check for reasonable TLV length */
++			if (length > 1024) {
++				zlog_warn("Malformed packet: TLV length too large (%u), skipping to end", length);
++				stream_forward_getp(s, STREAM_READABLE(s));
++				break;
++			}
++
++			/* Check if TLV extends beyond packet */
++			if (length > STREAM_READABLE(s) + 4) {
++				zlog_warn("Malformed packet: TLV length (%u) exceeds remaining data (%zu) + 4, skipping to end",
++						length, STREAM_READABLE(s));
++				break;
++		}
++		/* Skip current TLV data safely to move on to next TLV */
++		zlog_debug("Skipping unknown TLV: type=0x%04x, length=%u", type, length);
++		stream_forward_getp(s, length - 4);
++
++
+ 		}
+ 	}
+ 
+-- 
+2.47.3
+