Commit 5220cb63 authored by Ondřej Zajíček's avatar Ondřej Zajíček

Babel: Fix pointer arithmetic in subtlv parsing

The subtlv parsing code was doing byte-based arithmetic with non-void pointers,
causing it to read beyond the end of the packet.
Signed-off-by: Toke Høiland-Jørgensen's avatarToke Høiland-Jørgensen <toke@toke.dk>
parent 145ebfa1
......@@ -943,7 +943,7 @@ babel_read_subtlvs(struct babel_tlv *hdr,
struct babel_tlv *tlv;
for (tlv = (void *) hdr + state->current_tlv_endpos;
tlv < hdr + TLV_LENGTH(hdr);
(void *) tlv < (void *) hdr + TLV_LENGTH(hdr);
tlv = NEXT_TLV(tlv))
{
/*
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment