Commit f46421416fb6b91513fb687d6503142cd99034a5

Authored by Shan Wei
Committed by David S. Miller
1 parent 4c46ee5258

ipv6: fix overlap check for fragments

The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int,
and offset is int.

Without this patch, type conversion occurred to this expression, when
(FRAG6_CB(prev)->offset + prev->len) is less than offset.

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

net/ipv6/reassembly.c
... ... @@ -349,7 +349,7 @@
349 349  
350 350 /* Check for overlap with preceding fragment. */
351 351 if (prev &&
352   - (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
  352 + (FRAG6_CB(prev)->offset + prev->len) > offset)
353 353 goto discard_fq;
354 354  
355 355 /* Look for overlap with succeeding segment. */