From 1b16493eaaf501cbedc9c3fdecc28518b362ceaf Mon Sep 17 00:00:00 2001 From: Donatas Abraitis Date: Mon, 10 Jul 2023 14:40:24 +0300 Subject: [PATCH] bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr) The total number of octets of the Sub-TLV Value field. The Sub-TLV Length field contains 1 octet if the Sub-TLV Type field contains a value in the range from 0-127. The Sub-TLV Length field contains two octets if the Sub-TLV Type field contains a value in the range from 128-255. Signed-off-by: Donatas Abraitis (cherry picked from commit 79563af564ad0fe5b9c8d95bf080d570f87b1859) --- bgpd/bgp_attr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index b5377d29fc..3767d28b1b 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -2664,7 +2664,9 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args) if (BGP_ATTR_ENCAP == type) { subtype = stream_getc(BGP_INPUT(peer)); - sublength = stream_getc(BGP_INPUT(peer)); + sublength = (subtype < 128) + ? stream_getc(BGP_INPUT(peer)) + : stream_getw(BGP_INPUT(peer)); length -= 2; #ifdef ENABLE_BGP_VNC } else { -- 2.39.5