From 79563af564ad0fe5b9c8d95bf080d570f87b1859 Mon Sep 17 00:00:00 2001 From: Donatas Abraitis Date: Mon, 10 Jul 2023 14:40:24 +0300 Subject: [PATCH] bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr) The total number of octets of the Sub-TLV Value field. The Sub-TLV Length field contains 1 octet if the Sub-TLV Type field contains a value in the range from 0-127. The Sub-TLV Length field contains two octets if the Sub-TLV Type field contains a value in the range from 128-255. Signed-off-by: Donatas Abraitis --- bgpd/bgp_attr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index 34422bf514ca..f45166418d21 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -2658,7 +2658,9 @@ static int bgp_attr_encap(uint8_t type, struct peer *peer, /* IN */ if (BGP_ATTR_ENCAP == type) { subtype = stream_getc(BGP_INPUT(peer)); - sublength = stream_getc(BGP_INPUT(peer)); + sublength = (subtype < 128) + ? stream_getc(BGP_INPUT(peer)) + : stream_getw(BGP_INPUT(peer)); length -= 2; #ifdef ENABLE_BGP_VNC } else {