bgpd: Fixed incorrect calculation of pointer location

com_index_to_delete[i] holds the location in lcom->val of where the
value is stored, we cannot just increment it by this value on each
iteration as we'll overflow the size of lcom->val.

Signed-off-by: Nigel Kukard <nkukard@lbsd.net>

diff --git a/bgpd/bgp_clist.c b/bgpd/bgp_clist.c
index 7104f17e5ebdeada7a438627d5769c733fc69f7f..162ea59a069eb7f3ffe645c2d30581f9dae3a969 100644 (file)
--- a/bgpd/bgp_clist.c
+++ b/bgpd/bgp_clist.c
@@ -941,9 +941,8 @@ struct lcommunity *lcommunity_list_match_delete(struct lcommunity *lcom,
        }
 
        /* Delete all of the communities we flagged for deletion */
-       ptr = lcom->val;
        for (i = delete_index - 1; i >= 0; i--) {
-               ptr += (com_index_to_delete[i] * LCOMMUNITY_SIZE);
+               ptr = lcom->val + (com_index_to_delete[i] * LCOMMUNITY_SIZE);
                lcommunity_del_val(lcom, ptr);
        }