From: Donatas Abraitis <donatas@opensourcerouting.org>
Date: Mon, 10 Jul 2023 11:40:24 +0000 (+0300)
Subject: bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr)
X-Git-Tag: docker/9.0.4~17^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=refs%2Fpull%2F16215%2Fhead;p=mirror%2Ffrr.git

bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr)

The total number of octets of the Sub-TLV Value field. The Sub-TLV Length field
contains 1 octet if the Sub-TLV Type field contains a value in the range from
0-127. The Sub-TLV Length field contains two octets if the Sub-TLV Type field
contains a value in the range from 128-255.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 79563af564ad0fe5b9c8d95bf080d570f87b1859)
---

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index b5377d29fc..3767d28b1b 100644
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -2664,7 +2664,9 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
 
 		if (BGP_ATTR_ENCAP == type) {
 			subtype = stream_getc(BGP_INPUT(peer));
-			sublength = stream_getc(BGP_INPUT(peer));
+			sublength = (subtype < 128)
+					    ? stream_getc(BGP_INPUT(peer))
+					    : stream_getw(BGP_INPUT(peer));
 			length -= 2;
 #ifdef ENABLE_BGP_VNC
 		} else {