From: Donatas Abraitis <donatas@opensourcerouting.org>
Date: Thu, 13 Jun 2024 06:00:21 +0000 (+0300)
Subject: bgpd: Check if we have real stream data for tunnel encapsulation sub-tlvs
X-Git-Tag: docker/10.1.0~27^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=refs%2Fpull%2F16291%2Fhead;p=mirror%2Ffrr.git

bgpd: Check if we have real stream data for tunnel encapsulation sub-tlvs

When the packet is malformed it can use whatever values it wants. Let's check
what the real data we have in a stream instead of relying on malformed values.

Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 9929486d6bdb28469a5b626a17d5bc9991c83ce3)
---

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 9f377589e9..18c7b13535 100644
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -2721,7 +2721,7 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
 		}
 	}
 
-	while (length >= 4) {
+	while (STREAM_READABLE(BGP_INPUT(peer)) >= 4) {
 		uint16_t subtype = 0;
 		uint16_t sublength = 0;
 		struct bgp_attr_encap_subtlv *tlv;