Commit 5220cb63 authored Jun 14, 2017 by Ondrej Zajicek (work)

Babel: Fix pointer arithmetic in subtlv parsing



The subtlv parsing code was doing byte-based arithmetic with non-void pointers,
causing it to read beyond the end of the packet.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

parent 145ebfa1

proto/babel/packets.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -943,7 +943,7 @@ babel_read_subtlvs(struct babel_tlv *hdr,
		struct babel_tlv *tlv;

		for (tlv = (void *) hdr + state->current_tlv_endpos;
		tlv < hdr + TLV_LENGTH(hdr);
		(void ) tlv < (void ) hdr + TLV_LENGTH(hdr);
		tlv = NEXT_TLV(tlv))
		{
		/*

Admin message