bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr)

The total number of octets of the Sub-TLV Value field. The Sub-TLV Length field
contains 1 octet if the Sub-TLV Type field contains a value in the range from
0-127. The Sub-TLV Length field contains two octets if the Sub-TLV Type field
contains a value in the range from 128-255.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 34422bf514ca4054ec1f2c0765eb74336721351b..f45166418d21508ba570ce755cd7e4ae36f29fcf 100644 (file)
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -2658,7 +2658,9 @@ static int bgp_attr_encap(uint8_t type, struct peer *peer, /* IN */
 
                if (BGP_ATTR_ENCAP == type) {
                        subtype = stream_getc(BGP_INPUT(peer));
-                       sublength = stream_getc(BGP_INPUT(peer));
+                       sublength = (subtype < 128)
+                                           ? stream_getc(BGP_INPUT(peer))
+                                           : stream_getw(BGP_INPUT(peer));
                        length -= 2;
 #ifdef ENABLE_BGP_VNC
                } else {