Babel: Fix pointer arithmetic in subtlv parsing

The subtlv parsing code was doing byte-based arithmetic with non-void pointers,
causing it to read beyond the end of the packet.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
This commit is contained in:
Ondrej Zajicek (work) 2017-06-14 12:34:43 +02:00
parent 145ebfa1df
commit 5220cb63e3

View file

@ -943,7 +943,7 @@ babel_read_subtlvs(struct babel_tlv *hdr,
struct babel_tlv *tlv; struct babel_tlv *tlv;
for (tlv = (void *) hdr + state->current_tlv_endpos; for (tlv = (void *) hdr + state->current_tlv_endpos;
tlv < hdr + TLV_LENGTH(hdr); (void *) tlv < (void *) hdr + TLV_LENGTH(hdr);
tlv = NEXT_TLV(tlv)) tlv = NEXT_TLV(tlv))
{ {
/* /*