diff options
| author | Alexis Dambricourt <alexis.dambricourt@gmail.com> | 2016-01-05 00:26:07 +0100 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2016-01-11 11:01:35 +0800 |
| commit | 3be9b3528debd985b7a84ace0626cacf5ffe5ec4 (patch) | |
| tree | a8f82a0cb4e2288623f664c7cb63300d1965e52c /net/l2tpv3.c | |
| parent | aa7f9966dfdff500bbbf1956d9e115b1fa8987a6 (diff) | |
| download | qemu-3be9b3528debd985b7a84ace0626cacf5ffe5ec4.zip qemu-3be9b3528debd985b7a84ace0626cacf5ffe5ec4.tar.gz qemu-3be9b3528debd985b7a84ace0626cacf5ffe5ec4.tar.bz2 | |
l2tpv3: fix cookie decoding
If a 32 bits l2tpv3 frame cookie MSB if set to 1, the cast to uint64_t
cookie will spread 1 to the four most significant bytes.
Then the condition (cookie != s->rx_cookie) becomes false.
Signed-off-by: Alexis Dambricourt <alexis.dambricourt@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'net/l2tpv3.c')
| -rw-r--r-- | net/l2tpv3.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/l2tpv3.c b/net/l2tpv3.c index 8e68e54..21d6119 100644 --- a/net/l2tpv3.c +++ b/net/l2tpv3.c @@ -325,7 +325,7 @@ static int l2tpv3_verify_header(NetL2TPV3State *s, uint8_t *buf) if (s->cookie_is_64) { cookie = ldq_be_p(buf + s->cookie_offset); } else { - cookie = ldl_be_p(buf + s->cookie_offset); + cookie = ldl_be_p(buf + s->cookie_offset) & 0xffffffffULL; } if (cookie != s->rx_cookie) { if (!s->header_mismatch) { |