lib: guard against padding garbage in ZAPI read

When reading in a nexthop from ZAPI, only set the fields that actually
have meaning.  While it shouldn't happen to begin with, we can otherwise
carry padding garbage into the unused leftover union bytes.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit 4a0e1419a69d07496c7adfb744beecd00e1efef2)

diff --git a/lib/zclient.c b/lib/zclient.c
index 0e832f0d8fe5a9779dd1a9e715ce44eaa4906515..b5a8244eaf0f5863bd33dcd746f4c79ac2081015 100644 (file)
--- a/lib/zclient.c
+++ b/lib/zclient.c
@@ -2180,7 +2180,27 @@ struct nexthop *nexthop_from_zapi_nexthop(const struct zapi_nexthop *znh)
        n->type = znh->type;
        n->vrf_id = znh->vrf_id;
        n->ifindex = znh->ifindex;
-       n->gate = znh->gate;
+
+       /* only copy values that have meaning - make sure "spare bytes" are
+        * left zeroed for hashing (look at _nexthop_hash_bytes)
+        */
+       switch (znh->type) {
+       case NEXTHOP_TYPE_BLACKHOLE:
+               n->bh_type = znh->bh_type;
+               break;
+       case NEXTHOP_TYPE_IPV4:
+       case NEXTHOP_TYPE_IPV4_IFINDEX:
+               n->gate.ipv4 = znh->gate.ipv4;
+               break;
+       case NEXTHOP_TYPE_IPV6:
+       case NEXTHOP_TYPE_IPV6_IFINDEX:
+               n->gate.ipv6 = znh->gate.ipv6;
+               break;
+       case NEXTHOP_TYPE_IFINDEX:
+               /* nothing, ifindex is always copied */
+               break;
+       }
+
        n->srte_color = znh->srte_color;
        n->weight = znh->weight;