Merge pull request FRRouting#16295 from FRRouting/mergify/bp/stable/8…

….5/pr-16214 bgpd: A couple more fixes for Tunnel encapsulation handling (backport FRRouting#16214)
opensourcerouting · Jun 25, 2024 · 7d4786c · 7d4786c
2 parents 96f4dde + 1352ab7
commit 7d4786c
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
@@ -2695,17 +2695,20 @@ static int bgp_attr_encap(struct bgp_attr_parser_args *args)
 		}
 	}
 
-	while (length >= 4) {
+	while (STREAM_READABLE(BGP_INPUT(peer)) >= 4) {
 		uint16_t subtype = 0;
 		uint16_t sublength = 0;
 		struct bgp_attr_encap_subtlv *tlv;
 
 		if (BGP_ATTR_ENCAP == type) {
 			subtype = stream_getc(BGP_INPUT(peer));
-			sublength = (subtype < 128)
-					    ? stream_getc(BGP_INPUT(peer))
-					    : stream_getw(BGP_INPUT(peer));
-			length -= 2;
+			if (subtype < 128) {
+				sublength = stream_getc(BGP_INPUT(peer));
+				length -= 2;
+			} else {
+				sublength = stream_getw(BGP_INPUT(peer));
+				length -= 3;
+			}
 #ifdef ENABLE_BGP_VNC
 		} else {
 			subtype = stream_getw(BGP_INPUT(peer));