Commit f46421416fb6b91513fb687d6503142cd99034a5
Committed by
David S. Miller
1 parent
4c46ee5258
Exists in
master
and in
7 other branches
ipv6: fix overlap check for fragments
The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int, and offset is int. Without this patch, type conversion occurred to this expression, when (FRAG6_CB(prev)->offset + prev->len) is less than offset. Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff
net/ipv6/reassembly.c
... | ... | @@ -349,7 +349,7 @@ |
349 | 349 | |
350 | 350 | /* Check for overlap with preceding fragment. */ |
351 | 351 | if (prev && |
352 | - (FRAG6_CB(prev)->offset + prev->len) - offset > 0) | |
352 | + (FRAG6_CB(prev)->offset + prev->len) > offset) | |
353 | 353 | goto discard_fq; |
354 | 354 | |
355 | 355 | /* Look for overlap with succeeding segment. */ |