diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2017-10-19 00:37:38 +0200 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2017-10-19 00:37:38 +0200 |
| commit | 12f7047895612c5368c476806a5127500b43243e (patch) | |
| tree | cf5618fd1369ad71bb3e01ef6c11ee5b97cfaf3a /bgpd/bgp_encap_tlv.c | |
| parent | Merge pull request #1333 from donaldsharp/command_py_leak (diff) | |
| download | frr-12f7047895612c5368c476806a5127500b43243e.tar.xz frr-12f7047895612c5368c476806a5127500b43243e.zip | |
bgpd: Fix off by one error introduced by 8c9cc7bbf657e3440d9bc758fe45aef5f43c989f
Commit 8c9cc7bbf657e3440d9bc758fe45aef5f43c989f changed the size
of the `struct bgp_attr_encap_subtlv` type to be a zero length
array at the end instead of having a 1 byte. All memory allocations
for this subsuquently were off by 1 byte since those were not
adjusted either.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'bgpd/bgp_encap_tlv.c')
| -rw-r--r-- | bgpd/bgp_encap_tlv.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/bgpd/bgp_encap_tlv.c b/bgpd/bgp_encap_tlv.c index 445750161..30a08098e 100644 --- a/bgpd/bgp_encap_tlv.c +++ b/bgpd/bgp_encap_tlv.c @@ -47,7 +47,7 @@ static struct bgp_attr_encap_subtlv *subtlv_encode_encap_l2tpv3_over_ip( assert(total <= 0xff); new = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + total); + sizeof(struct bgp_attr_encap_subtlv) + total); assert(new); new->type = BGP_ENCAP_SUBTLV_TYPE_ENCAPSULATION; new->length = total; @@ -72,7 +72,7 @@ subtlv_encode_encap_gre(struct bgp_tea_subtlv_encap_gre_key *st) assert(total <= 0xff); new = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + total); + sizeof(struct bgp_attr_encap_subtlv) + total); assert(new); new->type = BGP_ENCAP_SUBTLV_TYPE_ENCAPSULATION; new->length = total; @@ -95,7 +95,7 @@ subtlv_encode_encap_pbb(struct bgp_tea_subtlv_encap_pbb *st) assert(total <= 0xff); new = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + total); + sizeof(struct bgp_attr_encap_subtlv) + total); assert(new); new->type = BGP_ENCAP_SUBTLV_TYPE_ENCAPSULATION; new->length = total; @@ -128,7 +128,7 @@ subtlv_encode_proto_type(struct bgp_tea_subtlv_proto_type *st) assert(total <= 0xff); new = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + total); + sizeof(struct bgp_attr_encap_subtlv) + total); assert(new); new->type = BGP_ENCAP_SUBTLV_TYPE_PROTO_TYPE; new->length = total; @@ -150,7 +150,7 @@ subtlv_encode_color(struct bgp_tea_subtlv_color *st) assert(total <= 0xff); new = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + total); + sizeof(struct bgp_attr_encap_subtlv) + total); assert(new); new->type = BGP_ENCAP_SUBTLV_TYPE_COLOR; new->length = total; @@ -182,7 +182,7 @@ subtlv_encode_ipsec_ta(struct bgp_tea_subtlv_ipsec_ta *st) assert(total <= 0xff); new = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + total); + sizeof(struct bgp_attr_encap_subtlv) + total); assert(new); new->type = BGP_ENCAP_SUBTLV_TYPE_IPSEC_TA; new->length = total; @@ -206,7 +206,7 @@ subtlv_encode_remote_endpoint(struct bgp_tea_subtlv_remote_endpoint *st) assert(total <= 0xff); new = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + total); + sizeof(struct bgp_attr_encap_subtlv) + total); assert(new); new->type = BGP_ENCAP_SUBTLV_TYPE_REMOTE_ENDPOINT; new->length = total; @@ -404,7 +404,7 @@ void bgp_encap_type_vxlan_to_tlv( if (attr->encap_subtlvs) XFREE(MTYPE_ENCAP_TLV, attr->encap_subtlvs); tlv = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + 12); + sizeof(struct bgp_attr_encap_subtlv) + 12); tlv->type = 1; /* encapsulation type */ tlv->length = 12; if (bet->vnid) { |