From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58633) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aGEWO-0001NO-Ek for qemu-devel@nongnu.org; Mon, 04 Jan 2016 18:26:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aGEWJ-0000zc-Fn for qemu-devel@nongnu.org; Mon, 04 Jan 2016 18:26:40 -0500 Received: from mail-wm0-x22f.google.com ([2a00:1450:400c:c09::22f]:38486) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aGEWJ-0000z5-AG for qemu-devel@nongnu.org; Mon, 04 Jan 2016 18:26:35 -0500 Received: by mail-wm0-x22f.google.com with SMTP id b14so4862901wmb.1 for ; Mon, 04 Jan 2016 15:26:35 -0800 (PST) From: Alexis Dambricourt Date: Tue, 5 Jan 2016 00:26:07 +0100 Message-Id: <1451949967-30272-1-git-send-email-alexis.dambricourt@gmail.com> Subject: [Qemu-devel] [PATCH v2] l2tpv3: fix cookie decoding List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: jasowang@redhat.com If a 32 bits l2tpv3 frame cookie MSB if set to 1, the cast to uint64_t cookie will spread 1 to the four most significant bytes. Then the condition (cookie != s->rx_cookie) becomes false. Signed-off-by: Alexis Dambricourt --- net/l2tpv3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/l2tpv3.c b/net/l2tpv3.c index 8e68e54..21d6119 100644 --- a/net/l2tpv3.c +++ b/net/l2tpv3.c @@ -325,7 +325,7 @@ static int l2tpv3_verify_header(NetL2TPV3State *s, uint8_t *buf) if (s->cookie_is_64) { cookie = ldq_be_p(buf + s->cookie_offset); } else { - cookie = ldl_be_p(buf + s->cookie_offset); + cookie = ldl_be_p(buf + s->cookie_offset) & 0xffffffffULL; } if (cookie != s->rx_cookie) { if (!s->header_mismatch) { -- 2.6.4