Change #275101

Comments

print-bgp: subtract TLV header bytes from tlen in L2VPN parser
print_labeled_vpn_l2() reads a 3-byte TLV header (1-byte type +
2-byte length) per iteration and advances pptr by 3 bytes, but does
not subtract the header bytes from tlen. Only the data portion
(ttlv_len) is subtracted via tlen -= ttlv_len (default case) or
tlen-- per byte (case 1).

After N TLVs, tlen is 3*N bytes too high, so the while (tlen != 0)
loop continues past the L2VPN attribute boundary, interpreting
adjacent BGP path attribute data as TLV structures.

Fix by subtracting the 3-byte header from tlen immediately after
reading it.

Changed files

• print-bgp.c