diff options
| author | Martin Mares <mj@ucw.cz> | 2003-02-22 11:25:22 +0100 |
|---|---|---|
| committer | Martin Mares <mj@ucw.cz> | 2003-02-22 11:25:22 +0100 |
| commit | 60a72ed49b36aea732d3584527040a7b3b0e72e0 (patch) | |
| tree | d56b25a3160db88543fabc569bc5e06489509122 /proto/bgp | |
| parent | 47f18ac39a313cf213b43320557239c5d0855a11 (diff) | |
| download | bird-60a72ed49b36aea732d3584527040a7b3b0e72e0.tar bird-60a72ed49b36aea732d3584527040a7b3b0e72e0.zip | |
Fixed length check miscalculation in IPv6 receive path.
Diffstat (limited to 'proto/bgp')
| -rw-r--r-- | proto/bgp/packets.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c index ffee9f7..ea980d1 100644 --- a/proto/bgp/packets.c +++ b/proto/bgp/packets.c @@ -602,7 +602,7 @@ bgp_do_rx_update(struct bgp_conn *conn, if (len < 1 || (*x != 16 && *x != 32) || len < *x + 2) goto bad; memcpy(bgp_attach_attr(&a0->eattrs, bgp_linpool, BA_NEXT_HOP, 16), x+1, 16); - len -= *x + 1; + len -= *x + 2; x += *x + 1; /* Ignore SNPA info */ |