bgpd: Fixed incorrect calculation of pointer location

com_index_to_delete[i] holds the location in lcom->val of where the
value is stored, we cannot just increment it by this value on each
iteration as we'll overflow the size of lcom->val.

Signed-off-by: Nigel Kukard <nkukard@lbsd.net>

diff --git a/bgpd/bgp_clist.c b/bgpd/bgp_clist.c
index 0830fba13a5ffeaece66d231e910dafb160d6d05..6f8ec61d8afcbee60be682c03b1029db881e017f 100644 (file)
--- a/bgpd/bgp_clist.c
+++ b/bgpd/bgp_clist.c
@@ -943,9 +943,8 @@ struct lcommunity *lcommunity_list_match_delete(struct lcommunity *lcom,
        }
 
        /* Delete all of the communities we flagged for deletion */
-       ptr = lcom->val;
        for (i = delete_index - 1; i >= 0; i--) {
-               ptr += (com_index_to_delete[i] * LCOMMUNITY_SIZE);
+               ptr = lcom->val + (com_index_to_delete[i] * LCOMMUNITY_SIZE);
                lcommunity_del_val(lcom, ptr);
        }