Merge pull request #16293 from FRRouting/mergify/bp/stable/9.1/pr-16214

bgpd: A couple more fixes for Tunnel encapsulation handling (backport #16214)
FRRouting · Jun 25, 2024 · dca6ed0 · dca6ed0
2 parents d1b69e0 + 5389197
commit dca6ed0
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
@@ -2700,17 +2700,20 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
  }
  }
 
- while (length >= 4) {
+ while (STREAM_READABLE(BGP_INPUT(peer)) >= 4) {
  uint16_t subtype = 0;
  uint16_t sublength = 0;
  struct bgp_attr_encap_subtlv *tlv;
 
  if (BGP_ATTR_ENCAP == type) {
  subtype = stream_getc(BGP_INPUT(peer));
- sublength = (subtype < 128)
- ? stream_getc(BGP_INPUT(peer))
- : stream_getw(BGP_INPUT(peer));
- length -= 2;
+ if (subtype < 128) {
+ sublength = stream_getc(BGP_INPUT(peer));
+ length -= 2;
+ } else {
+ sublength = stream_getw(BGP_INPUT(peer));
+ length -= 3;
+ }
 #ifdef ENABLE_BGP_VNC
  } else {
  subtype = stream_getw(BGP_INPUT(peer));