Skip to content

Commit

Permalink
ipv6: rpl: fix loop iteration
Browse files Browse the repository at this point in the history
This patch fix the loop iteration by not walking over the last
iteration. The cmpri compressing value exempt the last segment. As the
code shows the last iteration will be overwritten by cmpre value
handling which is for the last segment.

I think this doesn't end in any bufferoverflows because we work on worst
case temporary buffer sizes but it ends in not best compression settings
in some cases.

Fixes: 8610c7c ("net: ipv6: add support for rpl sr exthdr")
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Alexander Aring authored and David S. Miller committed Apr 6, 2020
1 parent bee3489 commit a7f9a6f
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions net/ipv6/rpl.c
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ void ipv6_rpl_srh_decompress(struct ipv6_rpl_sr_hdr *outhdr,
outhdr->cmpri = 0;
outhdr->cmpre = 0;

for (i = 0; i <= n; i++)
for (i = 0; i < n; i++)
ipv6_rpl_addr_decompress(&outhdr->rpl_segaddr[i], daddr,
ipv6_rpl_segdata_pos(inhdr, i),
inhdr->cmpri);
Expand All @@ -66,7 +66,7 @@ static unsigned char ipv6_rpl_srh_calc_cmpri(const struct ipv6_rpl_sr_hdr *inhdr
int i;

for (plen = 0; plen < sizeof(*daddr); plen++) {
for (i = 0; i <= n; i++) {
for (i = 0; i < n; i++) {
if (daddr->s6_addr[plen] !=
inhdr->rpl_segaddr[i].s6_addr[plen])
return plen;
Expand Down Expand Up @@ -114,7 +114,7 @@ void ipv6_rpl_srh_compress(struct ipv6_rpl_sr_hdr *outhdr,
outhdr->cmpri = cmpri;
outhdr->cmpre = cmpre;

for (i = 0; i <= n; i++)
for (i = 0; i < n; i++)
ipv6_rpl_addr_compress(ipv6_rpl_segdata_pos(outhdr, i),
&inhdr->rpl_segaddr[i], cmpri);

Expand Down

0 comments on commit a7f9a6f

Please sign in to comment.