Commit f4642141 authored by Shan Wei's avatar Shan Wei Committed by David S. Miller

ipv6: fix overlap check for fragments

The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int,
and offset is int.

Without this patch, type conversion occurred to this expression, when
(FRAG6_CB(prev)->offset + prev->len) is less than offset.
Signed-off-by: default avatarShan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4c46ee52
...@@ -349,7 +349,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, ...@@ -349,7 +349,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
/* Check for overlap with preceding fragment. */ /* Check for overlap with preceding fragment. */
if (prev && if (prev &&
(FRAG6_CB(prev)->offset + prev->len) - offset > 0) (FRAG6_CB(prev)->offset + prev->len) > offset)
goto discard_fq; goto discard_fq;
/* Look for overlap with succeeding segment. */ /* Look for overlap with succeeding segment. */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment