Check for multiple source prefixes, discard TLV.

Source prefix can be specified only once.

message.c

@@ -137,6 +137,8 @@ parse_update_subtlv(struct interface *ifp, int metric, int ae,
         }
     }
 
+    *src_plen = 0;
+
     while(i < alen) {
         type = a[i];
         if(type == SUBTLV_PAD1) {
@@ -159,6 +161,10 @@ parse_update_subtlv(struct interface *ifp, int metric, int ae,
             int rc;
             if(len < 1)
                 goto fail;
+            if(a[i + 2] == 0)   /* source prefix cannot be default */
+                goto fail;
+            if(*src_plen != 0)  /* source prefix can only be specified once */
+                goto fail;
             *src_plen = a[i + 2];
             rc = network_prefix(ae, *src_plen, 0, a + i + 3, NULL,
                                 len - 1, src_prefix);
@@ -299,6 +305,8 @@ parse_request_subtlv(int ae, const unsigned char *a, int alen,
 {
     int type, len, i = 0;
 
+    *src_plen = 0;
+
     while(i < alen) {
         type = a[0];
         if(type == SUBTLV_PAD1) {
@@ -319,6 +327,10 @@ parse_request_subtlv(int ae, const unsigned char *a, int alen,
             int rc;
             if(len < 1)
                 goto fail;
+            if(a[i + 2] == 0)
+                goto fail;
+            if(*src_plen != 0)
+                goto fail;
             *src_plen = a[i + 2];
             rc = network_prefix(ae, *src_plen, 0, a + i + 3, NULL,
                                 len - 1, src_prefix);