Commit f4642141 authored Nov 05, 2010 by Shan Wei Committed by David S. Miller Nov 08, 2010

ipv6: fix overlap check for fragments



The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int,
and offset is int.

Without this patch, type conversion occurred to this expression, when
(FRAG6_CB(prev)->offset + prev->len) is less than offset.

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 4c46ee52

net/ipv6/reassembly.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -349,7 +349,7 @@ static int ip6_frag_queue(struct frag_queue fq, struct sk_buff skb,

		/* Check for overlap with preceding fragment. */
		if (prev &&
		(FRAG6_CB(prev)->offset + prev->len) - offset > 0)
		(FRAG6_CB(prev)->offset + prev->len) > offset)
		goto discard_fq;

		/* Look for overlap with succeeding segment. */