From 0a7dce9b9e82721ebf636a9ead267312425abbe8 Mon Sep 17 00:00:00 2001 From: Nigel Kukard Date: Wed, 30 Aug 2017 09:39:36 +0000 Subject: [PATCH] bgpd: Fixed incorrect calculation of pointer location com_index_to_delete[i] holds the location in lcom->val of where the value is stored, we cannot just increment it by this value on each iteration as we'll overflow the size of lcom->val. Signed-off-by: Nigel Kukard --- bgpd/bgp_clist.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/bgpd/bgp_clist.c b/bgpd/bgp_clist.c index 7104f17e5e..162ea59a06 100644 --- a/bgpd/bgp_clist.c +++ b/bgpd/bgp_clist.c @@ -941,9 +941,8 @@ struct lcommunity *lcommunity_list_match_delete(struct lcommunity *lcom, } /* Delete all of the communities we flagged for deletion */ - ptr = lcom->val; for (i = delete_index - 1; i >= 0; i--) { - ptr += (com_index_to_delete[i] * LCOMMUNITY_SIZE); + ptr = lcom->val + (com_index_to_delete[i] * LCOMMUNITY_SIZE); lcommunity_del_val(lcom, ptr); } -- 2.39.5