diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2017-10-19 00:37:38 +0200 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2017-10-19 00:37:38 +0200 |
| commit | 12f7047895612c5368c476806a5127500b43243e (patch) | |
| tree | cf5618fd1369ad71bb3e01ef6c11ee5b97cfaf3a /bgpd/bgp_attr.c | |
| parent | Merge pull request #1333 from donaldsharp/command_py_leak (diff) | |
| download | frr-12f7047895612c5368c476806a5127500b43243e.tar.xz frr-12f7047895612c5368c476806a5127500b43243e.zip | |
bgpd: Fix off by one error introduced by 8c9cc7bbf657e3440d9bc758fe45aef5f43c989f
Commit 8c9cc7bbf657e3440d9bc758fe45aef5f43c989f changed the size
of the `struct bgp_attr_encap_subtlv` type to be a zero length
array at the end instead of having a 1 byte. All memory allocations
for this subsuquently were off by 1 byte since those were not
adjusted either.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'bgpd/bgp_attr.c')
| -rw-r--r-- | bgpd/bgp_attr.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index c178089af..2d3158d84 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -208,7 +208,7 @@ struct bgp_attr_encap_subtlv *encap_tlv_dup(struct bgp_attr_encap_subtlv *orig) struct bgp_attr_encap_subtlv *p; for (p = orig, tail = new = NULL; p; p = p->next) { - int size = sizeof(struct bgp_attr_encap_subtlv) - 1 + p->length; + int size = sizeof(struct bgp_attr_encap_subtlv) + p->length; if (tail) { tail->next = XCALLOC(MTYPE_ENCAP_TLV, size); tail = tail->next; @@ -1916,7 +1916,7 @@ static int bgp_attr_encap(uint8_t type, struct peer *peer, /* IN */ /* alloc and copy sub-tlv */ /* TBD make sure these are freed when attributes are released */ tlv = XCALLOC(MTYPE_ENCAP_TLV, - sizeof(struct bgp_attr_encap_subtlv) - 1 + sizeof(struct bgp_attr_encap_subtlv) + sublength); tlv->type = subtype; tlv->length = sublength; |