bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr)

The total number of octets of the Sub-TLV Value field. The Sub-TLV Length field
contains 1 octet if the Sub-TLV Type field contains a value in the range from
0-127. The Sub-TLV Length field contains two octets if the Sub-TLV Type field
contains a value in the range from 128-255.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 79563af564ad0fe5b9c8d95bf080d570f87b1859)

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 7570598a3d7f229be3b60a27ec280877c02b4350..5cfde373735af7b79fd65a5935144e1716bbf857 100644 (file)
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -2702,7 +2702,9 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
 
                if (BGP_ATTR_ENCAP == type) {
                        subtype = stream_getc(BGP_INPUT(peer));
-                       sublength = stream_getc(BGP_INPUT(peer));
+                       sublength = (subtype < 128)
+                                           ? stream_getc(BGP_INPUT(peer))
+                                           : stream_getw(BGP_INPUT(peer));
                        length -= 2;
 #ifdef ENABLE_BGP_VNC
                } else {