Merge tag 'v1.6.2' into int-new

2 files changed, 17 insertions, 16 deletions

diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c
index d85afa8f..b8371f32 100644
--- a/proto/bgp/attrs.c
+++ b/proto/bgp/attrs.c
@@ -118,7 +118,7 @@ validate_path(struct bgp_proto *p, int as_path, int bs, byte *idata, uint *ileng
 {
   int res = 0;
   u8 *a, *dst;
-  int len, plen, copy;
+  int len, plen;
 
   dst = a = idata;
   len = *ilength;
@@ -132,15 +132,20 @@ validate_path(struct bgp_proto *p, int as_path, int bs, byte *idata, uint *ileng
       if (len < plen)
 	return -1;
 
+      if (a[1] == 0)
+        {
+	  log(L_WARN "%s: %s_PATH attribute contains empty segment, skipping it",
+	      p->p.name, as_path ? "AS" : "AS4");
+	  goto skip;
+	}
+
       switch (a[0])
 	{
 	case AS_PATH_SET:
-	  copy = 1;
 	  res++;
 	  break;
 
 	case AS_PATH_SEQUENCE:
-	  copy = 1;
 	  res += a[1];
 	  break;
 
@@ -154,20 +159,17 @@ validate_path(struct bgp_proto *p, int as_path, int bs, byte *idata, uint *ileng
 
 	  log(L_WARN "%s: %s_PATH attribute contains AS_CONFED_* segment, skipping segment",
 	      p->p.name, as_path ? "AS" : "AS4");
-	  copy = 0;
-	  break;
+	  goto skip;
 
 	default:
 	  return -1;
 	}
 
-      if (copy)
-	{
-	  if (dst != a)
-	    memmove(dst, a, plen);
-	  dst += plen;
-	}
+      if (dst != a)
+	memmove(dst, a, plen);
+      dst += plen;
 
+    skip:
       len -= plen;
       a += plen;
     }
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 72ca3728..0cf38edf 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -369,7 +369,7 @@ bgp_create_update(struct bgp_conn *conn, byte *buf)
     }
   put_u16(buf, wd_size);
 
-  if (remains >= 3072)
+  if (!wd_size)
     {
       while ((buck = (struct bgp_bucket *) HEAD(p->bucket_queue))->send_node.next)
 	{
@@ -382,7 +382,7 @@ bgp_create_update(struct bgp_conn *conn, byte *buf)
 	    }
 
 	  DBG("Processing bucket %p\n", buck);
-	  a_size = bgp_encode_attrs(p, w+2, buck->eattrs, 2048);
+	  a_size = bgp_encode_attrs(p, w+2, buck->eattrs, remains - 1024);
 
 	  if (a_size < 0)
 	    {
@@ -461,8 +461,7 @@ bgp_create_update(struct bgp_conn *conn, byte *buf)
       w += size;
       remains -= size;
     }
-
-  if (remains >= 3072)
+  else
     {
       while ((buck = (struct bgp_bucket *) HEAD(p->bucket_queue))->send_node.next)
 	{
@@ -478,7 +477,7 @@ bgp_create_update(struct bgp_conn *conn, byte *buf)
 	  rem_stored = remains;
 	  w_stored = w;
 
-	  size = bgp_encode_attrs(p, w, buck->eattrs, 2048);
+	  size = bgp_encode_attrs(p, w, buck->eattrs, remains - 1024);
 	  if (size < 0)
 	    {
 	      log(L_ERR "%s: Attribute list too long, skipping corresponding routes", p->p.name);