From 60a72ed49b36aea732d3584527040a7b3b0e72e0 Mon Sep 17 00:00:00 2001 From: Martin Mares Date: Sat, 22 Feb 2003 10:25:22 +0000 Subject: [PATCH] Fixed length check miscalculation in IPv6 receive path. --- proto/bgp/packets.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c index ffee9f7b..ea980d11 100644 --- a/proto/bgp/packets.c +++ b/proto/bgp/packets.c @@ -602,7 +602,7 @@ bgp_do_rx_update(struct bgp_conn *conn, if (len < 1 || (*x != 16 && *x != 32) || len < *x + 2) goto bad; memcpy(bgp_attach_attr(&a0->eattrs, bgp_linpool, BA_NEXT_HOP, 16), x+1, 16); - len -= *x + 1; + len -= *x + 2; x += *x + 1; /* Ignore SNPA info */