Jerry/bird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Babel: Fix pointer arithmetic in subtlv parsing

Browse source 
The subtlv parsing code was doing byte-based arithmetic with non-void pointers,
causing it to read beyond the end of the packet.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
This commit is contained in:
Ondrej Zajicek (work) 2017-06-14 12:34:43 +02:00
parent 145ebfa1df
commit 5220cb63e3
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
proto/babel/packets.c
View file

@ -943,7 +943,7 @@ babel_read_subtlvs(struct babel_tlv *hdr,
struct babel_tlv *tlv; struct babel_tlv *tlv;
for (tlv = (void *) hdr + state->current_tlv_endpos; for (tlv = (void *) hdr + state->current_tlv_endpos;
tlv < hdr + TLV_LENGTH(hdr); (void *) tlv < (void *) hdr + TLV_LENGTH(hdr);
tlv = NEXT_TLV(tlv)) tlv = NEXT_TLV(tlv))
{ {
/* /*