From 60a72ed49b36aea732d3584527040a7b3b0e72e0 Mon Sep 17 00:00:00 2001
From: Martin Mares <mj@ucw.cz>
Date: Sat, 22 Feb 2003 10:25:22 +0000
Subject: Fixed length check miscalculation in IPv6 receive path.

---
 proto/bgp/packets.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'proto/bgp/packets.c')

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index ffee9f7b..ea980d11 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -602,7 +602,7 @@ bgp_do_rx_update(struct bgp_conn *conn,
       if (len < 1 || (*x != 16 && *x != 32) || len < *x + 2)
 	goto bad;
       memcpy(bgp_attach_attr(&a0->eattrs, bgp_linpool, BA_NEXT_HOP, 16), x+1, 16);
-      len -= *x + 1;
+      len -= *x + 2;
       x += *x + 1;
 
       /* Ignore SNPA info */
-- 
cgit v1.2.3