lkml.org 
[lkml]   [2017]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 237/250] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 63117f09c768be05a0bf465911297dc76394f686 upstream.

    Casting is a high precedence operation but "off" and "i" are in terms of
    bytes so we need to have some parenthesis here.

    Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    net/ipv6/ip6_tunnel.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
    index 33bf1c1..61a8995 100644
    --- a/net/ipv6/ip6_tunnel.c
    +++ b/net/ipv6/ip6_tunnel.c
    @@ -435,7 +435,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
    if (i + sizeof(*tel) > optlen)
    break;

    - tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i;
    + tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
    /* return index of option if found and valid */
    if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
    tel->length == 1)
    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2017-06-12 01:16    [W:4.776 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site