Revert "bgpd: fix illegal memory access in bgp_ls_tlv_check_size()"

This reverts commit dae5791c446cd18d8cda93a1e578fff2cd27be10.

(cherry picked from commit 73a4891ab39bf22f5d0120b378fb7d6cd4b75dd5)

diff --git a/bgpd/bgp_linkstate_tlv.c b/bgpd/bgp_linkstate_tlv.c
index 97a024d7cd4fe639d232b70c61d37454b468d0d2..a8b13d78768a40515379dd36bbf6054b89eba871 100644 (file)
--- a/bgpd/bgp_linkstate_tlv.c
+++ b/bgpd/bgp_linkstate_tlv.c
@@ -31,7 +31,7 @@ struct bgp_linkstate_tlv_info {
 #define UNDEF_MULTPL 1
 
 /* clang-format off */
-struct bgp_linkstate_tlv_info bgp_linkstate_tlv_infos[BGP_LS_TLV_MAX + 1] = {
+struct bgp_linkstate_tlv_info bgp_linkstate_tlv_infos[BGP_LS_TLV_MAX] = {
        /* NLRI TLV */
        [BGP_LS_TLV_LOCAL_NODE_DESCRIPTORS] = {"Local Node Descriptors", 1, MAX_SZ, UNDEF_MULTPL},
        [BGP_LS_TLV_REMOTE_NODE_DESCRIPTORS] = {"Remote Node Descriptors", 1, MAX_SZ, UNDEF_MULTPL},
@@ -1705,7 +1705,7 @@ void bgp_linkstate_tlv_attribute_display(struct vty *vty,
                        json_tlv = json_object_new_object();
                        json_object_object_add(json, tlv_type, json_tlv);
 
-                       if (type <= BGP_LS_TLV_MAX &&
+                       if (type < BGP_LS_TLV_MAX &&
                            bgp_linkstate_tlv_infos[type].descr != NULL)
                                json_object_string_add(
                                        json_tlv, "description",
@@ -1720,7 +1720,7 @@ void bgp_linkstate_tlv_attribute_display(struct vty *vty,
                                        "too high length received: %u", length);
                                break;
                        }
-                       if (type <= BGP_LS_TLV_MAX &&
+                       if (type < BGP_LS_TLV_MAX &&
                            bgp_linkstate_tlv_infos[type].descr != NULL &&
                            !bgp_ls_tlv_check_size(type, length))
                                json_object_string_addf(
@@ -1728,7 +1728,7 @@ void bgp_linkstate_tlv_attribute_display(struct vty *vty,
                                        "unexpected length received: %u",
                                        length);
                } else {
-                       if (type <= BGP_LS_TLV_MAX &&
+                       if (type < BGP_LS_TLV_MAX &&
                            bgp_linkstate_tlv_infos[type].descr != NULL)
                                vty_out(vty, "%*s%s: ", indent, "",
                                        bgp_linkstate_tlv_infos[type].descr);

diff --git a/bgpd/bgp_linkstate_tlv.h b/bgpd/bgp_linkstate_tlv.h
index cc543735b77f096c9105d5660c2695baee51524f..ad3b2570d671ea28854479a3bbded9e0ca91f6ad 100644 (file)
--- a/bgpd/bgp_linkstate_tlv.h
+++ b/bgpd/bgp_linkstate_tlv.h
@@ -197,7 +197,7 @@ enum bgp_linkstate_tlv {
                1251, /* draft-ietf-idr-bgpls-srv6-ext-08 */
        BGP_LS_TLV_SRV6_SID_STRUCTURE_TLV =
                1252,          /* draft-ietf-idr-bgpls-srv6-ext-08 */
-       BGP_LS_TLV_MAX = 1252, /* max TLV value for table size*/
+       BGP_LS_TLV_MAX = 1253, /* max TLV value for table size*/
 };
 
 /* RFC7752 #3.2.1.4 IGP router-ID */