bgpd: Adjust the length of tunnel encap sub-tlv by sub-tlv type

Fixes: 79563af564ad0fe5b9c8d95bf080d570f87b1859 ("bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr)")
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index da4701d069db7f1c064dc24fe77a512fff3d25b0..9f377589e960d9d71bf7c2fcfbc9c96efae483b5 100644 (file)
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -2728,10 +2728,13 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
 
                if (BGP_ATTR_ENCAP == type) {
                        subtype = stream_getc(BGP_INPUT(peer));
-                       sublength = (subtype < 128)
-                                           ? stream_getc(BGP_INPUT(peer))
-                                           : stream_getw(BGP_INPUT(peer));
-                       length -= 2;
+                       if (subtype < 128) {
+                               sublength = stream_getc(BGP_INPUT(peer));
+                               length -= 2;
+                       } else {
+                               sublength = stream_getw(BGP_INPUT(peer));
+                               length -= 3;
+                       }
 #ifdef ENABLE_BGP_VNC
                } else {
                        subtype = stream_getw(BGP_INPUT(peer));