From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36720) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aIV77-0003HP-Oi for qemu-devel@nongnu.org; Mon, 11 Jan 2016 00:33:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aIV77-0008TZ-17 for qemu-devel@nongnu.org; Mon, 11 Jan 2016 00:33:57 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35486) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aIV76-0008TQ-RD for qemu-devel@nongnu.org; Mon, 11 Jan 2016 00:33:56 -0500 From: Jason Wang Date: Mon, 11 Jan 2016 13:31:14 +0800 Message-Id: <1452490275-18217-24-git-send-email-jasowang@redhat.com> In-Reply-To: <1452490275-18217-1-git-send-email-jasowang@redhat.com> References: <1452490275-18217-1-git-send-email-jasowang@redhat.com> Subject: [Qemu-devel] [PULL 23/24] l2tpv3: fix cookie decoding List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: peter.maydell@linaro.org, qemu-devel@nongnu.org Cc: Jason Wang , Alexis Dambricourt From: Alexis Dambricourt If a 32 bits l2tpv3 frame cookie MSB if set to 1, the cast to uint64_t cookie will spread 1 to the four most significant bytes. Then the condition (cookie != s->rx_cookie) becomes false. Signed-off-by: Alexis Dambricourt Signed-off-by: Jason Wang --- net/l2tpv3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/l2tpv3.c b/net/l2tpv3.c index 8e68e54..21d6119 100644 --- a/net/l2tpv3.c +++ b/net/l2tpv3.c @@ -325,7 +325,7 @@ static int l2tpv3_verify_header(NetL2TPV3State *s, uint8_t *buf) if (s->cookie_is_64) { cookie = ldq_be_p(buf + s->cookie_offset); } else { - cookie = ldl_be_p(buf + s->cookie_offset); + cookie = ldl_be_p(buf + s->cookie_offset) & 0xffffffffULL; } if (cookie != s->rx_cookie) { if (!s->header_mismatch) { -- 2.5.0