aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorAlexis Dambricourt <alexis.dambricourt@gmail.com>2016-01-05 00:26:07 +0100
committerJason Wang <jasowang@redhat.com>2016-01-11 11:01:35 +0800
commit3be9b3528debd985b7a84ace0626cacf5ffe5ec4 (patch)
treea8f82a0cb4e2288623f664c7cb63300d1965e52c /net
parentaa7f9966dfdff500bbbf1956d9e115b1fa8987a6 (diff)
downloadqemu-3be9b3528debd985b7a84ace0626cacf5ffe5ec4.zip
qemu-3be9b3528debd985b7a84ace0626cacf5ffe5ec4.tar.gz
qemu-3be9b3528debd985b7a84ace0626cacf5ffe5ec4.tar.bz2
l2tpv3: fix cookie decoding
If a 32 bits l2tpv3 frame cookie MSB if set to 1, the cast to uint64_t cookie will spread 1 to the four most significant bytes. Then the condition (cookie != s->rx_cookie) becomes false. Signed-off-by: Alexis Dambricourt <alexis.dambricourt@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'net')
-rw-r--r--net/l2tpv3.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/l2tpv3.c b/net/l2tpv3.c
index 8e68e54..21d6119 100644
--- a/net/l2tpv3.c
+++ b/net/l2tpv3.c
@@ -325,7 +325,7 @@ static int l2tpv3_verify_header(NetL2TPV3State *s, uint8_t *buf)
if (s->cookie_is_64) {
cookie = ldq_be_p(buf + s->cookie_offset);
} else {
- cookie = ldl_be_p(buf + s->cookie_offset);
+ cookie = ldl_be_p(buf + s->cookie_offset) & 0xffffffffULL;
}
if (cookie != s->rx_cookie) {
if (!s->header_mismatch) {