bgpd: Adjust the length of tunnel encap sub-tlv by sub-tlv type

Fixes: 79563af564ad0fe5b9c8d95bf080d570f87b1859 ("bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr)")
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 34b209f0ae2caca0d1ebcde9d4095375ac31b562)

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 5cfde373735af7b79fd65a5935144e1716bbf857..76b698d759f32ec0243254a55217eae7a860fca1 100644 (file)
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -2702,10 +2702,13 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
 
                if (BGP_ATTR_ENCAP == type) {
                        subtype = stream_getc(BGP_INPUT(peer));
-                       sublength = (subtype < 128)
-                                           ? stream_getc(BGP_INPUT(peer))
-                                           : stream_getw(BGP_INPUT(peer));
-                       length -= 2;
+                       if (subtype < 128) {
+                               sublength = stream_getc(BGP_INPUT(peer));
+                               length -= 2;
+                       } else {
+                               sublength = stream_getw(BGP_INPUT(peer));
+                               length -= 3;
+                       }
 #ifdef ENABLE_BGP_VNC
                } else {
                        subtype = stream_getw(BGP_INPUT(peer));