bgpd: Get 1 or 2 octets for Sub-TLV length (Tunnel Encap attr)

The total number of octets of the Sub-TLV Value field. The Sub-TLV Length field contains 1 octet if the Sub-TLV Type field contains a value in the range from 0-127. The Sub-TLV Length field contains two octets if the Sub-TLV Type field contains a value in the range from 128-255. Signed-off-by: Donatas Abraitis <[email protected]>
opensourcerouting · Jul 10, 2023 · 79563af · 79563af
1 parent f5b8a4e
commit 79563af
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
@@ -2658,7 +2658,9 @@ static int bgp_attr_encap(uint8_t type, struct peer *peer, /* IN */
 
 		if (BGP_ATTR_ENCAP == type) {
 			subtype = stream_getc(BGP_INPUT(peer));
-			sublength = stream_getc(BGP_INPUT(peer));
+			sublength = (subtype < 128)
+					    ? stream_getc(BGP_INPUT(peer))
+					    : stream_getw(BGP_INPUT(peer));
 			length -= 2;
 #ifdef ENABLE_BGP_VNC
 		} else {