Bug#1143453: trixie-pu: package bird2/2.17.6-0+deb13u1

--5Lfgo0g5VgC9vPS0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:bird2
User: [email protected]
Usertags: pu

Upstream released a new bug fixes only release targeting stable.

It contains multiple bug fixes, detailed in the NEWS file, which solve=20
actual reliability issues.
Future upstream releases with security updates will be based on this=20
release.

git diff debian/2.17.5-0+deb13u1..debian/bird2/trixie ':(exclude).gitlab-ci=
=2Eyml' ':(exclude)gitlab/'

diff --git a/NEWS b/NEWS
index d420203e4..52c28ba5c 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,11 @@
+Version 2.17.6 (2026-07-30)
+  o BGP: Fix stack buffer overflow in Flowspec NLRI decoder
+  o BGP: Minor improvements in Flowspec parsing
+  o BGP: Fix minor issues with send hold timer
+  o Fix null byte handling in authentication keys
+  o Filter: Fix zero arg handling
+  o Update bird-users mailing list links
+
 Version 2.17.5 (2026-06-09)
   o BGP: Fix several issues in Flowspec handling
   o BMP: Fix off-by-one buffer overflow
diff --git a/README b/README
index 75a4281f1..9edadb033 100644
--- a/README
+++ b/README
@@ -71,8 +71,8 @@ around to see what's going to develop, feel free to subsc=
ribe to the BIRD
 users mailing list [email protected], just send `subscribe' to
 [email protected].
=20
-Subscribe:	http://bird.network.cz/mailman/listinfo/bird-users/
-Archive:	http://bird.network.cz/pipermail/bird-users/
+Subscribe:	https://bird.nic.cz/lists/bird-users/
+Archive:	https://bird.nic.cz/lists/bird-users/archive/
=20
 Please don't send security issues to the mailing-list, contact us instead =
at
 [email protected] which is a private e-mail address where you also c=
an
diff --git a/VERSION b/VERSION
index 00db22659..728789a53 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.17.5
+2.17.6
diff --git a/conf/flowspec.Y b/conf/flowspec.Y
index 3b71e3ff9..d073a1204 100644
--- a/conf/flowspec.Y
+++ b/conf/flowspec.Y
@@ -59,7 +59,7 @@ flow_num_type_:
  | ICMP CODE	{ $$ =3D FLOW_TYPE_ICMP_CODE; }
  | LENGTH	{ $$ =3D FLOW_TYPE_PACKET_LENGTH; }
  | DSCP		{ $$ =3D FLOW_TYPE_DSCP; }
- | LABEL	{ $$ =3D FLOW_TYPE_LABEL; }
+ | LABEL	{ $$ =3D FLOW_TYPE_LABEL; if (!this_flow->ipv6) cf_error("Flow la=
bel not valid in flow4"); }
  ;
=20
 flow_num_type: flow_num_type_{ flow_builder_set_type(this_flow, $1); };
@@ -123,7 +123,7 @@ flow_neg:
  ;
=20
 flow_frag_val:
-   DONT_FRAGMENT  { $$ =3D 1; }
+   DONT_FRAGMENT  { $$ =3D 1; if (this_flow->ipv6) cf_error("Flag dont_fra=
gment not valid in flow6"); }
  | IS_FRAGMENT	  { $$ =3D 2; }
  | FIRST_FRAGMENT { $$ =3D 4; }
  | LAST_FRAGMENT  { $$ =3D 8; }
diff --git a/debian/changelog b/debian/changelog
index ec7bbb15e..b72808706 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+bird2 (2.17.6-0+deb13u1) stable; urgency=3Dmedium
+
+  * New upstream release.
+
+ -- Marco d'Itri <[email protected]>  Sun, 02 Aug 2026 05:32:37 +0200
+
 bird2 (2.17.5-0+deb13u1) trixie-security; urgency=3Dmedium
=20
   * New upstream release.
diff --git a/debian/watch b/debian/watch
index cec2d6646..4c8198618 100644
--- a/debian/watch
+++ b/debian/watch
@@ -1,2 +1,2 @@
 version=3D4
-https://bird.network.cz/download/bird-(2\.[\d.]+).tar.gz
+https://bird.nic.cz/download/ bird-(2\.[\d.]+).tar.gz
diff --git a/doc/bird.sgml b/doc/bird.sgml
index 7277b7525..f9c540286 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -6717,7 +6717,7 @@ versions of BIRD:
 (<HTMLURL URL=3D"mailto:[email protected]" name=3D"bird-users@network.=
cz">)
 where you can share your experiences with the other users and consult
 your problems with the authors. To subscribe to the list, visit
-<HTMLURL URL=3D"https://bird.network.cz/mailman/listinfo/bird-users" name=
=3D"https://bird.network.cz/mailman/listinfo/bird-users">.
+<HTMLURL URL=3D"https://bird.nic.cz/lists/bird-users/" name=3D"https://bir=
d.nic.cz/lists/bird-users/">.
 The home page of BIRD can be found at <HTMLURL URL=3D"http://bird.nic.cz/"=
 name=3D"http://bird.nic.cz/">.
=20
 <p>BIRD is a relatively young system and it probably contains some bugs. Y=
ou can
diff --git a/filter/filter.c b/filter/filter.c
index f17de58c2..1c9b5dbcf 100644
--- a/filter/filter.c
+++ b/filter/filter.c
@@ -170,7 +170,7 @@ interpret(struct filter_state *fs, const struct f_line =
*line, uint argc, const s
=20
   /* Set the arguments and top-level variables */
   fstk->vcnt =3D line->vars + line->args;
-  memcpy(fstk->vstk, argv, sizeof(struct f_val) * line->args);
+  bmemcpy(fstk->vstk, argv, sizeof(struct f_val) * line->args);
   memset(fstk->vstk + line->args, 0, sizeof(struct f_val) * line->vars);
=20
   /* The same as with the value stack. Not resetting the stack completely =
for performance reasons. */
diff --git a/lib/flowspec.c b/lib/flowspec.c
index c534054fa..343c296bc 100644
--- a/lib/flowspec.c
+++ b/lib/flowspec.c
@@ -350,17 +350,17 @@ static const u8 flow_max_value_length[FLOW_TYPE_MAX] =
=3D {
   [FLOW_TYPE_FRAGMENT]		=3D 1,
 };
=20
-/* Maximum valid numeric values (in bytes), semantically */
+/* Maximum valid numeric values (in bits), semantically */
 static const u8 flow_max_valid_value[FLOW_TYPE_MAX] =3D {
-  [FLOW_TYPE_IP_PROTOCOL]	=3D 1,
-  [FLOW_TYPE_PORT]		=3D 2,
-  [FLOW_TYPE_DST_PORT]		=3D 2,
-  [FLOW_TYPE_SRC_PORT]		=3D 2,
-  [FLOW_TYPE_ICMP_TYPE]		=3D 1,
-  [FLOW_TYPE_ICMP_CODE]		=3D 1,
-  [FLOW_TYPE_PACKET_LENGTH]	=3D 2,
-  [FLOW_TYPE_DSCP]		=3D 1,
-  [FLOW_TYPE_LABEL]		=3D 4,
+  [FLOW_TYPE_IP_PROTOCOL]	=3D 8,
+  [FLOW_TYPE_PORT]		=3D 16,
+  [FLOW_TYPE_DST_PORT]		=3D 16,
+  [FLOW_TYPE_SRC_PORT]		=3D 16,
+  [FLOW_TYPE_ICMP_TYPE]		=3D 8,
+  [FLOW_TYPE_ICMP_CODE]		=3D 8,
+  [FLOW_TYPE_PACKET_LENGTH]	=3D 16,
+  [FLOW_TYPE_DSCP]		=3D 6,
+  [FLOW_TYPE_LABEL]		=3D 20,
 };
=20
 /**
@@ -405,16 +405,10 @@ void
 flow_check_cf_numeric_arg(struct flow_builder *fb, uint val)
 {
   enum flow_type t =3D fb->this_type;
-  uint max =3D flow_max_valid_value[t];
+  u64 max =3D (U64(1) << flow_max_valid_value[t]) - 1;
=20
-  if (t =3D=3D FLOW_TYPE_DSCP && val > 0x3f)
-    cf_error("%s value %u out of range (0-63)", flow_type_str(t, fb->ipv6)=
, val);
-
-  if (max =3D=3D 1 && (val > 0xff))
-    cf_error("%s value %u out of range (0-255)", flow_type_str(t, fb->ipv6=
), val);
-
-  if (max =3D=3D 2 && (val > 0xffff))
-    cf_error("%s value %u out of range (0-65535)", flow_type_str(t, fb->ip=
v6), val);
+  if (max && (val > max))
+    cf_error("%s value %u out of range (0-%lu)", flow_type_str(t, fb->ipv6=
), val, max);
 }
=20
 /* Bitmask of padding bits in last byte of prefix */
diff --git a/lib/string.h b/lib/string.h
index 8831666c7..736ca57f5 100644
--- a/lib/string.h
+++ b/lib/string.h
@@ -94,6 +94,14 @@ bmemcpy(void *dest, const void *src, size_t n)
     return dest;
 }
=20
+static inline void *
+memcpy0(void *dst, const void *src, size_t dst_len, size_t src_len)
+{
+  memset(dst, 0, dst_len);
+  memcpy(dst, src, MIN_(dst_len, src_len));
+  return dst;
+}
+
 #define ROUTER_ID_64_LENGTH 23
=20
 #endif
diff --git a/nest/password.h b/nest/password.h
index 53168bb7c..e3251a31e 100644
--- a/nest/password.h
+++ b/nest/password.h
@@ -26,10 +26,10 @@ struct password_item *password_find_by_id(list *l, uint=
 id);
 struct password_item *password_find_by_value(list *l, char *pass, uint siz=
e);
 void password_validate_length(const struct password_item *p);
=20
-static inline int password_verify(struct password_item *p1, char *p2, uint=
 size)
+static inline int password_verify(const struct password_item *p1, const ch=
ar *p2, uint size)
 {
   char buf[size];
-  strncpy(buf, p1->password, size);
+  memcpy0(buf, p1->password, size, p1->length);
   return !memcmp(buf, p2, size);
 }
=20
diff --git a/proto/bfd/packets.c b/proto/bfd/packets.c
index 6097bcae5..2ed6a9f25 100644
--- a/proto/bfd/packets.c
+++ b/proto/bfd/packets.c
@@ -148,7 +148,7 @@ bfd_fill_authentication(struct bfd_proto *p, struct bfd=
_session *s, struct bfd_c
   {
     struct bfd_crypto_auth *auth =3D (void *) (pkt + 1);
     uint hash_alg =3D bfd_auth_type_to_hash_alg[cf->auth_type];
-    uint hash_len =3D mac_type_length(pass->alg);
+    uint hash_len =3D mac_type_length(hash_alg);
=20
     /* Increase CSN about one time per second */
     u32 new_time =3D (u64) current_time() >> 20;
@@ -169,7 +169,8 @@ bfd_fill_authentication(struct bfd_proto *p, struct bfd=
_session *s, struct bfd_c
     pkt->flags |=3D BFD_FLAG_AP;
     pkt->length +=3D auth->length;
=20
-    strncpy(auth->data, pass->password, hash_len);
+    memcpy0(auth->data, pass->password, hash_len, pass->length);
+
     mac_fill(hash_alg, NULL, 0, (byte *) pkt, pkt->length, auth->data);
     return;
   }
@@ -262,7 +263,7 @@ bfd_check_authentication(struct bfd_proto *p, struct bf=
d_session *s, struct bfd_
=20
     byte *auth_data =3D alloca(hash_len);
     memcpy(auth_data, auth->data, hash_len);
-    strncpy(auth->data, pass->password, hash_len);
+    memcpy0(auth->data, pass->password, hash_len, pass->length);
=20
     if (!mac_verify(hash_alg, NULL, 0, (byte *) pkt, pkt->length, auth_dat=
a))
       DROP("wrong authentication code", pass->id);
diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index 818edeeba..29833c1e7 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -2587,6 +2587,9 @@ bgp_postconfig(struct proto_config *CF)
   if (cf->keepalive_time > (cf->hold_time / 2))
     log(L_WARN "Keepalive time should be at most 1/2 of hold time");
=20
+  if ((cf->send_hold_time > 0) && (cf->send_hold_time < cf->hold_time))
+    cf_error("Send hold time must be zero or at least hold time");
+
   if (cf->min_hold_time > cf->hold_time)
     cf_error("Min hold time (%u) exceeds hold time (%u)",
 	     cf->min_hold_time, cf->hold_time);
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index b345283e0..232155ee4 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -922,12 +922,14 @@ bgp_rx_open(struct bgp_conn *conn, byte *pkt, uint le=
n)
=20
   /* Compute effective hold and keepalive times */
   uint hold_time =3D MIN(hold, p->cf->hold_time);
+  uint base_hold_time =3D p->cf->hold_time ?: 1;
+
   uint keepalive_time =3D p->cf->keepalive_time ?
-    (p->cf->keepalive_time * hold_time / p->cf->hold_time) :
+    (p->cf->keepalive_time * hold_time / base_hold_time) :
     hold_time / 3;
=20
   uint send_hold_time =3D (p->cf->send_hold_time >=3D 0) ?
-    (p->cf->send_hold_time * hold_time / p->cf->hold_time) :
+    ((u64) p->cf->send_hold_time * hold_time / base_hold_time) :
     2 * hold_time;
=20
   /* Keepalive time might be rounded down to zero */
@@ -2104,7 +2106,7 @@ bgp_decode_nlri_flow4(struct bgp_parse_state *s, byte=
 *pos, uint len, rta *a)
     uint pxlen =3D 0;
=20
     /* Decode dst prefix */
-    if (data[0] =3D=3D FLOW_TYPE_DST_PREFIX)
+    if (dlen && (data[0] =3D=3D FLOW_TYPE_DST_PREFIX))
     {
       px =3D flow_read_ip4_part(data);
       pxlen =3D flow_read_pxlen(data);
@@ -2199,7 +2201,7 @@ bgp_decode_nlri_flow6(struct bgp_parse_state *s, byte=
 *pos, uint len, rta *a)
     uint pxlen =3D 0;
=20
     /* Decode dst prefix */
-    if (data[0] =3D=3D FLOW_TYPE_DST_PREFIX)
+    if (dlen && (data[0] =3D=3D FLOW_TYPE_DST_PREFIX))
     {
       px =3D flow_read_ip6_part(data);
       pxlen =3D flow_read_pxlen(data);
diff --git a/proto/ospf/packet.c b/proto/ospf/packet.c
index 1c9aafa4f..9104f9fc9 100644
--- a/proto/ospf/packet.c
+++ b/proto/ospf/packet.c
@@ -64,7 +64,8 @@ ospf_pkt_finalize2(struct ospf_iface *ifa, struct ospf_pa=
cket *pkt, uint *plen)
       log(L_ERR "No suitable password found for authentication");
       return;
     }
-    strncpy(auth->password, pass->password, sizeof(auth->password));
+    memcpy0(auth->password, pass->password, sizeof(auth->password), pass->=
length);
+
     /* fallthrough */
=20
   case OSPF_AUTH_NONE:
@@ -111,7 +112,7 @@ ospf_pkt_finalize2(struct ospf_iface *ifa, struct ospf_=
packet *pkt, uint *plen)
=20
     /* Append key for keyed hash, append padding for HMAC (RFC 5709 3.3) */
     if (pass->alg < ALG_HMAC)
-      strncpy(auth_tail, pass->password, auth_len);
+      memcpy0(auth_tail, pass->password, auth_len, pass->length);
     else
       memset32(auth_tail, HMAC_MAGIC, auth_len / 4);
=20
@@ -235,7 +236,7 @@ ospf_pkt_checkauth2(struct ospf_neighbor *n, struct osp=
f_iface *ifa, struct ospf
=20
     /* Append key for keyed hash, append padding for HMAC (RFC 5709 3.3) */
     if (pass->alg < ALG_HMAC)
-      strncpy(auth_tail, pass->password, auth_len);
+      memcpy0(auth_tail, pass->password, auth_len, pass->length);
     else
       memset32(auth_tail, HMAC_MAGIC, auth_len / 4);
=20
diff --git a/proto/rip/packets.c b/proto/rip/packets.c
index 9c3bd7a3b..7eaa30f38 100644
--- a/proto/rip/packets.c
+++ b/proto/rip/packets.c
@@ -274,7 +274,7 @@ rip_fill_authentication(struct rip_proto *p, struct rip=
_iface *ifa, struct rip_p
   case RIP_AUTH_PLAIN:
     auth->must_be_ffff =3D htons(0xffff);
     auth->auth_type =3D htons(RIP_AUTH_PLAIN);
-    strncpy(auth->password, pass->password, RIP_PASSWD_LENGTH);
+    memcpy0(auth->password, pass->password, sizeof(auth->password), pass->=
length);
     return;
=20
   case RIP_AUTH_CRYPTO:
@@ -313,7 +313,7 @@ rip_fill_authentication(struct rip_proto *p, struct rip=
_iface *ifa, struct rip_p
=20
     /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */
     if (pass->alg < ALG_HMAC)
-      strncpy(tail->auth_data, pass->password, auth_len);
+      memcpy0(tail->auth_data, pass->password, auth_len, pass->length);
     else
       memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4);
=20
@@ -402,7 +402,7 @@ rip_check_authentication(struct rip_proto *p, struct ri=
p_iface *ifa, struct rip_
=20
     /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */
     if (pass->alg < ALG_HMAC)
-      strncpy(tail->auth_data, pass->password, auth_len);
+      memcpy0(tail->auth_data, pass->password, auth_len, pass->length);
     else
       memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4);
=20

--=20
ciao,
Marco

--5Lfgo0g5VgC9vPS0
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQnKUXNg20437dCfobLPsM64d7XgQUCam7CbwAKCRDLPsM64d7X
gWDrAQCPpdEmzqr4TLQN3XtKxdGrZA+uJG3oDb3vdBGzodchZgD/QpTTothxQ4B8
m2mAWoCr2Sibu2RlcNb06sqv9xD/6QI=
=FFsB
-----END PGP SIGNATURE-----

--5Lfgo0g5VgC9vPS0--