- Fix bgpd crash. More information is at:

  http://lists.quagga.net/pipermail/quagga-users/2009-February/010342.html
  This crash can be triggered remotely.

PR:		ports/134108
Submitted by:	Eugene Grosbein <eugen@eg.svzserv.kuzbass.ru>
Approved by:	Boris Kovalenko <boris@tagnet.ru> (maintainer)

10 files changed, 377 insertions, 1 deletions

diff --git a/net/quagga/Makefile b/net/quagga/Makefile
index 073540e1afd5..afd9764b8416 100644
--- a/net/quagga/Makefile
+++ b/net/quagga/Makefile
@@ -7,7 +7,7 @@
 
 PORTNAME=	quagga
 PORTVERSION=	0.99.11
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	net ipv6
 MASTER_SITES=	http://quagga.net/download/ \
 		http://www.ru.quagga.net/download/ \
diff --git a/net/quagga/files/patch-bgp_aspath.c b/net/quagga/files/patch-bgp_aspath.c
new file mode 100644
index 000000000000..dcee86a45f7c
--- /dev/null
+++ b/net/quagga/files/patch-bgp_aspath.c
@@ -0,0 +1,127 @@
+--- bgpd/bgp_aspath.c.orig	2008-09-05 22:27:26.000000000 +0800
++++ bgpd/bgp_aspath.c	2009-04-30 16:33:56.000000000 +0800
+@@ -393,25 +393,6 @@
+   return ' ';
+ }
+ 
+-/* countup asns from this segment and index onward */
+-static int
+-assegment_count_asns (struct assegment *seg, int from)
+-{
+-  int count = 0;
+-  while (seg)
+-    {
+-      if (!from)
+-        count += seg->length;
+-      else
+-        {
+-          count += (seg->length - from);
+-          from = 0;
+-        }
+-      seg = seg->next;
+-    }
+-  return count;
+-}
+-
+ unsigned int
+ aspath_count_confeds (struct aspath *aspath)
+ {
+@@ -521,6 +502,21 @@
+   return num;
+ }
+ 
++static void
++aspath_make_str_big_enough (int len,
++			    char **str_buf,
++			    int *str_size,
++			    int count_to_be_added)
++{
++#define TERMINATOR 1
++  while (len + count_to_be_added + TERMINATOR > *str_size)
++    {
++      *str_size *= 2;
++      *str_buf = XREALLOC (MTYPE_AS_STR, *str_buf, *str_size);
++    }
++#undef TERMINATOR
++}
++
+ /* Convert aspath structure to string expression. */
+ static char *
+ aspath_make_str_count (struct aspath *as)
+@@ -540,18 +536,7 @@
+   
+   seg = as->segments;
+   
+-  /* ASN takes 5 chars at least, plus seperator, see below.
+-   * If there is one differing segment type, we need an additional
+-   * 2 chars for segment delimiters, and the final '\0'.
+-   * Hopefully this is large enough to avoid hitting the realloc
+-   * code below for most common sequences.
+-   *
+-   * With 32bit ASNs, this range will increase, but only worth changing
+-   * once there are significant numbers of ASN >= 100000
+-   */
+-#define ASN_STR_LEN (5 + 1)
+-  str_size = MAX (assegment_count_asns (seg, 0) * ASN_STR_LEN + 2 + 1,
+-                  ASPATH_STR_DEFAULT_LEN);
++  str_size = ASPATH_STR_DEFAULT_LEN;
+   str_buf = XMALLOC (MTYPE_AS_STR, str_size);
+ 
+   while (seg)
+@@ -575,32 +560,24 @@
+             return NULL;
+         }
+       
+-      /* We might need to increase str_buf, particularly if path has
+-       * differing segments types, our initial guesstimate above will
+-       * have been wrong.  need 5 chars for ASN, a seperator each and
+-       * potentially two segment delimiters, plus a space between each
+-       * segment and trailing zero.
+-       *
+-       * This may need to revised if/when significant numbers of
+-       * ASNs >= 100000 are assigned and in-use on the internet...
+-       */
+-#define SEGMENT_STR_LEN(X) (((X)->length * ASN_STR_LEN) + 2 + 1 + 1)
+-      if ( (len + SEGMENT_STR_LEN(seg)) > str_size)
+-        {
+-          str_size = len + SEGMENT_STR_LEN(seg);
+-          str_buf = XREALLOC (MTYPE_AS_STR, str_buf, str_size);
+-        }
+-#undef ASN_STR_LEN
+-#undef SEGMENT_STR_LEN
+-      
+       if (seg->type != AS_SEQUENCE)
+-        len += snprintf (str_buf + len, str_size - len, 
+-			 "%c", 
+-                         aspath_delimiter_char (seg->type, AS_SEG_START));
++	{
++	  aspath_make_str_big_enough (len, &str_buf, &str_size, 1); /* %c */
++	  len += snprintf (str_buf + len, str_size - len, 
++			   "%c", 
++			   aspath_delimiter_char (seg->type, AS_SEG_START));
++	}
+       
+       /* write out the ASNs, with their seperators, bar the last one*/
+       for (i = 0; i < seg->length; i++)
+         {
++#define APPROX_DIG_CNT(x) (x < 100000U ? 5 : 10)
++	  /* %u + %c + %c + " " (last two are below loop) */
++	  aspath_make_str_big_enough (len,
++				      &str_buf,
++				      &str_size,
++				      APPROX_DIG_CNT(seg->as[i]) + 1 + 1 + 1);
++
+           len += snprintf (str_buf + len, str_size - len, "%u", seg->as[i]);
+           
+           if (i < (seg->length - 1))
+@@ -1771,8 +1748,8 @@
+ static int
+ aspath_cmp (const void *arg1, const void *arg2)
+ {
+-  const struct assegment *seg1 = ((struct aspath *)arg1)->segments;
+-  const struct assegment *seg2 = ((struct aspath *)arg2)->segments;
++  const struct assegment *seg1 = ((const struct aspath *)arg1)->segments;
++  const struct assegment *seg2 = ((const struct aspath *)arg2)->segments;
+   
+   while (seg1 || seg2)
+     {
diff --git a/net/quagga/files/patch-bgp_attr.c b/net/quagga/files/patch-bgp_attr.c
new file mode 100644
index 000000000000..49c4af383fa4
--- /dev/null
+++ b/net/quagga/files/patch-bgp_attr.c
@@ -0,0 +1,11 @@
+--- bgpd/bgp_attr.c.orig	2008-10-02 16:28:50.000000000 +0800
++++ bgpd/bgp_attr.c	2009-04-30 16:33:56.000000000 +0800
+@@ -857,7 +857,7 @@
+ 	  && ! aspath_firstas_check (attr->aspath, peer->as))
+  	{
+  	  zlog (peer->log, LOG_ERR,
+- 		"%s incorrect first AS (must be %d)", peer->host, peer->as);
++ 		"%s incorrect first AS (must be %u)", peer->host, peer->as);
+  	  bgp_notify_send (peer,
+  			   BGP_NOTIFY_UPDATE_ERR,
+  			   BGP_NOTIFY_UPDATE_MAL_AS_PATH);
diff --git a/net/quagga/files/patch-bgp_community.c b/net/quagga/files/patch-bgp_community.c
new file mode 100644
index 000000000000..76c98acb1a78
--- /dev/null
+++ b/net/quagga/files/patch-bgp_community.c
@@ -0,0 +1,11 @@
+--- bgpd/bgp_community.c.orig	2008-09-05 22:27:26.000000000 +0800
++++ bgpd/bgp_community.c	2009-04-30 16:33:56.000000000 +0800
+@@ -282,7 +282,7 @@
+ 	default:
+ 	  as = (comval >> 16) & 0xFFFF;
+ 	  val = comval & 0xFFFF;
+-	  sprintf (pnt, "%d:%d", as, val);
++	  sprintf (pnt, "%u:%d", as, val);
+ 	  pnt += strlen (pnt);
+ 	  break;
+ 	}
diff --git a/net/quagga/files/patch-bgp_debug.c b/net/quagga/files/patch-bgp_debug.c
new file mode 100644
index 000000000000..69f17331f1fb
--- /dev/null
+++ b/net/quagga/files/patch-bgp_debug.c
@@ -0,0 +1,10 @@
+--- bgpd/bgp_debug.c.orig	2008-09-05 22:27:26.000000000 +0800
++++ bgpd/bgp_debug.c	2009-04-30 16:33:56.000000000 +0800
+@@ -205,7 +205,7 @@
+     snprintf (buf + strlen (buf), size - strlen (buf), ", atomic-aggregate");
+ 
+   if (CHECK_FLAG (attr->flag, ATTR_FLAG_BIT (BGP_ATTR_AGGREGATOR)))
+-    snprintf (buf + strlen (buf), size - strlen (buf), ", aggregated by %d %s",
++    snprintf (buf + strlen (buf), size - strlen (buf), ", aggregated by %u %s",
+ 	      attr->extra->aggregator_as,
+ 	      inet_ntoa (attr->extra->aggregator_addr));
diff --git a/net/quagga/files/patch-bgp_ecommunity.c b/net/quagga/files/patch-bgp_ecommunity.c
new file mode 100644
index 000000000000..624ee221a29a
--- /dev/null
+++ b/net/quagga/files/patch-bgp_ecommunity.c
@@ -0,0 +1,20 @@
+--- bgpd/bgp_ecommunity.c.orig	2008-09-05 22:27:26.000000000 +0800
++++ bgpd/bgp_ecommunity.c	2009-04-30 16:33:56.000000000 +0800
+@@ -673,7 +673,7 @@
+ 	  eas.val = (*pnt++ << 8);
+ 	  eas.val |= (*pnt++);
+ 
+-	  len = sprintf( str_buf + str_pnt, "%s%d:%d", prefix,
++	  len = sprintf( str_buf + str_pnt, "%s%u:%d", prefix,
+                         eas.as, eas.val );
+ 	  str_pnt += len;
+ 	  first = 0;
+@@ -688,7 +688,7 @@
+ 	  eas.val |= (*pnt++ << 8);
+ 	  eas.val |= (*pnt++);
+ 
+-	  len = sprintf (str_buf + str_pnt, "%s%d:%d", prefix,
++	  len = sprintf (str_buf + str_pnt, "%s%u:%d", prefix,
+ 			 eas.as, eas.val);
+ 	  str_pnt += len;
+ 	  first = 0;
diff --git a/net/quagga/files/patch-bgp_packet.c b/net/quagga/files/patch-bgp_packet.c
new file mode 100644
index 000000000000..7b6cde9ee421
--- /dev/null
+++ b/net/quagga/files/patch-bgp_packet.c
@@ -0,0 +1,38 @@
+--- bgpd/bgp_packet.c.orig	2008-09-10 04:18:57.000000000 +0800
++++ bgpd/bgp_packet.c	2009-04-30 16:33:56.000000000 +0800
+@@ -813,7 +813,7 @@
+   length = bgp_packet_set_size (s);
+ 
+   if (BGP_DEBUG (normal, NORMAL))
+-    zlog_debug ("%s sending OPEN, version %d, my as %d, holdtime %d, id %s", 
++    zlog_debug ("%s sending OPEN, version %d, my as %u, holdtime %d, id %s", 
+ 	       peer->host, BGP_VERSION_4, local_as,
+ 	       send_holdtime, inet_ntoa (peer->local_id));
+ 
+@@ -1184,7 +1184,7 @@
+ 
+   /* Receive OPEN message log  */
+   if (BGP_DEBUG (normal, NORMAL))
+-    zlog_debug ("%s rcv OPEN, version %d, remote-as (in open) %d,"
++    zlog_debug ("%s rcv OPEN, version %d, remote-as (in open) %u,"
+                 " holdtime %d, id %s",
+ 	        peer->host, version, remote_as, holdtime,
+ 	        inet_ntoa (remote_id));
+@@ -1277,7 +1277,7 @@
+ 	  else
+ 	    {
+ 	      if (BGP_DEBUG (normal, NORMAL))
+-		zlog_debug ("%s bad OPEN, remote AS is %d, expected %d",
++		zlog_debug ("%s bad OPEN, remote AS is %u, expected %u",
+ 			    peer->host, remote_as, peer->as);
+ 	      bgp_notify_send_with_data (peer, BGP_NOTIFY_OPEN_ERR,
+ 					 BGP_NOTIFY_OPEN_BAD_PEER_AS,
+@@ -1430,7 +1430,7 @@
+   if (remote_as != peer->as)
+     {
+       if (BGP_DEBUG (normal, NORMAL))
+-	zlog_debug ("%s bad OPEN, remote AS is %d, expected %d",
++	zlog_debug ("%s bad OPEN, remote AS is %u, expected %u",
+ 		   peer->host, remote_as, peer->as);
+       bgp_notify_send_with_data (peer, 
+ 				 BGP_NOTIFY_OPEN_ERR, 
diff --git a/net/quagga/files/patch-bgp_route.c b/net/quagga/files/patch-bgp_route.c
new file mode 100644
index 000000000000..28a8f6ae5bdb
--- /dev/null
+++ b/net/quagga/files/patch-bgp_route.c
@@ -0,0 +1,38 @@
+--- bgpd/bgp_route.c.orig	2008-10-02 16:28:50.000000000 +0800
++++ bgpd/bgp_route.c	2009-04-30 16:33:56.000000000 +0800
+@@ -834,7 +834,7 @@
+     {
+       if (BGP_DEBUG (filter, FILTER))  
+         zlog (peer->log, LOG_DEBUG, 
+-	      "%s [Update:SEND] suppress announcement to peer AS %d is AS path.",
++	      "%s [Update:SEND] suppress announcement to peer AS %u is AS path.",
+ 	      peer->host, peer->as);
+       return 0;
+     }
+@@ -847,7 +847,7 @@
+ 	{
+ 	  if (BGP_DEBUG (filter, FILTER))  
+ 	    zlog (peer->log, LOG_DEBUG, 
+-		  "%s [Update:SEND] suppress announcement to peer AS %d is AS path.",
++		  "%s [Update:SEND] suppress announcement to peer AS %u is AS path.",
+ 		  peer->host,
+ 		  bgp->confed_id);
+ 	  return 0;
+@@ -1163,7 +1163,7 @@
+     {
+       if (BGP_DEBUG (filter, FILTER))
+         zlog (rsclient->log, LOG_DEBUG,
+-             "%s [Update:SEND] suppress announcement to peer AS %d is AS path.",
++             "%s [Update:SEND] suppress announcement to peer AS %u is AS path.",
+              rsclient->host, rsclient->as);
+       return 0;
+     }
+@@ -5956,7 +5956,7 @@
+       if (CHECK_FLAG (binfo->flags, BGP_INFO_STALE))
+ 	vty_out (vty, ", (stale)");
+       if (CHECK_FLAG (attr->flag, ATTR_FLAG_BIT (BGP_ATTR_AGGREGATOR)))
+-	vty_out (vty, ", (aggregated by %d %s)", 
++	vty_out (vty, ", (aggregated by %u %s)", 
+ 	         attr->extra->aggregator_as,
+ 		 inet_ntoa (attr->extra->aggregator_addr));
+       if (CHECK_FLAG (binfo->peer->af_flags[afi][safi], PEER_FLAG_REFLECTOR_CLIENT))
diff --git a/net/quagga/files/patch-bgp_vty.c b/net/quagga/files/patch-bgp_vty.c
new file mode 100644
index 000000000000..713b94db6a12
--- /dev/null
+++ b/net/quagga/files/patch-bgp_vty.c
@@ -0,0 +1,76 @@
+--- bgpd/bgp_vty.c.orig	2008-09-11 13:46:49.000000000 +0800
++++ bgpd/bgp_vty.c	2009-04-30 16:33:56.000000000 +0800
+@@ -334,11 +334,11 @@
+ 	       VTY_NEWLINE);
+       return CMD_WARNING;
+     case BGP_ERR_AS_MISMATCH:
+-      vty_out (vty, "BGP is already running; AS is %d%s", as, VTY_NEWLINE);
++      vty_out (vty, "BGP is already running; AS is %u%s", as, VTY_NEWLINE);
+       return CMD_WARNING;
+     case BGP_ERR_INSTANCE_MISMATCH:
+       vty_out (vty, "BGP view name and AS number mismatch%s", VTY_NEWLINE);
+-      vty_out (vty, "BGP instance is already running; AS is %d%s",
++      vty_out (vty, "BGP instance is already running; AS is %u%s",
+ 	       as, VTY_NEWLINE);
+       return CMD_WARNING;
+     }
+@@ -1280,10 +1280,10 @@
+   switch (ret)
+     {
+     case BGP_ERR_PEER_GROUP_MEMBER:
+-      vty_out (vty, "%% Peer-group AS %d. Cannot configure remote-as for member%s", as, VTY_NEWLINE);
++      vty_out (vty, "%% Peer-group AS %u. Cannot configure remote-as for member%s", as, VTY_NEWLINE);
+       return CMD_WARNING;
+     case BGP_ERR_PEER_GROUP_PEER_TYPE_DIFFERENT:
+-      vty_out (vty, "%% The AS# can not be changed from %d to %s, peer-group members must be all internal or all external%s", as, as_str, VTY_NEWLINE);
++      vty_out (vty, "%% The AS# can not be changed from %u to %s, peer-group members must be all internal or all external%s", as, as_str, VTY_NEWLINE);
+       return CMD_WARNING;
+     }
+   return bgp_vty_return (vty, ret);
+@@ -1601,7 +1601,7 @@
+ 
+   if (ret == BGP_ERR_PEER_GROUP_PEER_TYPE_DIFFERENT)
+     {
+-      vty_out (vty, "%% Peer with AS %d cannot be in this peer-group, members must be all internal or all external%s", as, VTY_NEWLINE);
++      vty_out (vty, "%% Peer with AS %u cannot be in this peer-group, members must be all internal or all external%s", as, VTY_NEWLINE);
+       return CMD_WARNING;
+     }
+ 
+@@ -6669,7 +6669,7 @@
+               
+               /* Usage summary and header */
+               vty_out (vty,
+-                       "BGP router identifier %s, local AS number %d%s",
++                       "BGP router identifier %s, local AS number %u%s",
+                        inet_ntoa (bgp->router_id), bgp->as, VTY_NEWLINE);
+ 
+               ents = bgp_table_count (bgp->rib[afi][safi]);
+@@ -6716,7 +6716,7 @@
+ 
+ 	  vty_out (vty, "4 ");
+ 
+-	  vty_out (vty, "%5d %7d %7d %8d %4d %4lu ",
++	  vty_out (vty, "%5u %7d %7d %8d %4d %4lu ",
+ 		   peer->as,
+ 		   peer->open_in + peer->update_in + peer->keepalive_in
+ 		   + peer->notify_in + peer->refresh_in + peer->dynamic_cap_in,
+@@ -7226,8 +7226,8 @@
+ 
+   /* Configured IP address. */
+   vty_out (vty, "BGP neighbor is %s, ", p->host);
+-  vty_out (vty, "remote AS %d, ", p->as);
+-  vty_out (vty, "local AS %d%s, ",
++  vty_out (vty, "remote AS %u, ", p->as);
++  vty_out (vty, "local AS %u%s, ",
+ 	   p->change_local_as ? p->change_local_as : p->local_as,
+ 	   CHECK_FLAG (p->flags, PEER_FLAG_LOCAL_AS_NO_PREPEND) ?
+ 	   " no-prepend" : "");
+@@ -8009,7 +8009,7 @@
+                       "Route Server's BGP router identifier %s%s",
+                       inet_ntoa (bgp->router_id), VTY_NEWLINE);
+              vty_out (vty,
+-              "Route Server's local AS number %d%s", bgp->as,
++              "Route Server's local AS number %u%s", bgp->as,
+                        VTY_NEWLINE);
+ 
+              vty_out (vty, "%s", VTY_NEWLINE);
diff --git a/net/quagga/files/patch-bgpd.c b/net/quagga/files/patch-bgpd.c
new file mode 100644
index 000000000000..f64b62d35a69
--- /dev/null
+++ b/net/quagga/files/patch-bgpd.c
@@ -0,0 +1,45 @@
+--- bgpd/bgpd.c.orig	2008-09-11 13:46:49.000000000 +0800
++++ bgpd/bgpd.c	2009-04-30 16:33:56.000000000 +0800
+@@ -4512,13 +4512,13 @@
+ 	    vty_out (vty, " neighbor %s peer-group%s", addr,
+ 		     VTY_NEWLINE);
+ 	  if (peer->as)
+-	    vty_out (vty, " neighbor %s remote-as %d%s", addr, peer->as,
++	    vty_out (vty, " neighbor %s remote-as %u%s", addr, peer->as,
+ 		     VTY_NEWLINE);
+ 	}
+       else
+ 	{
+ 	  if (! g_peer->as)
+-	    vty_out (vty, " neighbor %s remote-as %d%s", addr, peer->as,
++	    vty_out (vty, " neighbor %s remote-as %u%s", addr, peer->as,
+ 		     VTY_NEWLINE);
+ 	  if (peer->af_group[AFI_IP][SAFI_UNICAST])
+ 	    vty_out (vty, " neighbor %s peer-group %s%s", addr,
+@@ -4528,7 +4528,7 @@
+       /* local-as. */
+       if (peer->change_local_as)
+ 	if (! peer_group_active (peer))
+-	  vty_out (vty, " neighbor %s local-as %d%s%s", addr,
++	  vty_out (vty, " neighbor %s local-as %u%s%s", addr,
+ 		   peer->change_local_as,
+ 		   CHECK_FLAG (peer->flags, PEER_FLAG_LOCAL_AS_NO_PREPEND) ?
+ 		   " no-prepend" : "", VTY_NEWLINE);
+@@ -4917,7 +4917,7 @@
+ 	vty_out (vty, "!%s", VTY_NEWLINE);
+ 
+       /* Router bgp ASN */
+-      vty_out (vty, "router bgp %d", bgp->as);
++      vty_out (vty, "router bgp %u", bgp->as);
+ 
+       if (bgp_option_check (BGP_OPT_MULTIPLE_INSTANCE))
+ 	{
+@@ -4978,7 +4978,7 @@
+ 	  vty_out (vty, " bgp confederation peers");
+ 
+          for (i = 0; i < bgp->confed_peers_cnt; i++)
+-           vty_out(vty, " %d", bgp->confed_peers[i]);
++           vty_out(vty, " %u", bgp->confed_peers[i]);
+ 
+           vty_out (vty, "%s", VTY_NEWLINE);
+ 	}