From bc309a5d202b4adfc0d6e5a0eec595cc1359dd28 Mon Sep 17 00:00:00 2001 From: Donatas Abraitis Date: Thu, 13 Jun 2024 09:00:21 +0300 Subject: [PATCH] bgpd: Check if we have real stream data for tunnel encapsulation sub-tlvs When the packet is malformed it can use whatever values it wants. Let's check what the real data we have in a stream instead of relying on malformed values. Reported-by: Iggy Frankovic Signed-off-by: Donatas Abraitis (cherry picked from commit 9929486d6bdb28469a5b626a17d5bc9991c83ce3) --- bgpd/bgp_attr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index b03be23671..0023a01768 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -2657,7 +2657,7 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args) } } - while (length >= 4) { + while (STREAM_READABLE(BGP_INPUT(peer)) >= 4) { uint16_t subtype = 0; uint16_t sublength = 0; struct bgp_attr_encap_subtlv *tlv; -- 2.39.5