From 3be9b3528debd985b7a84ace0626cacf5ffe5ec4 Mon Sep 17 00:00:00 2001 From: Alexis Dambricourt Date: Tue, 5 Jan 2016 00:26:07 +0100 Subject: l2tpv3: fix cookie decoding If a 32 bits l2tpv3 frame cookie MSB if set to 1, the cast to uint64_t cookie will spread 1 to the four most significant bytes. Then the condition (cookie != s->rx_cookie) becomes false. Signed-off-by: Alexis Dambricourt Signed-off-by: Jason Wang --- net/l2tpv3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/l2tpv3.c b/net/l2tpv3.c index 8e68e540ec..21d6119ed4 100644 --- a/net/l2tpv3.c +++ b/net/l2tpv3.c @@ -325,7 +325,7 @@ static int l2tpv3_verify_header(NetL2TPV3State *s, uint8_t *buf) if (s->cookie_is_64) { cookie = ldq_be_p(buf + s->cookie_offset); } else { - cookie = ldl_be_p(buf + s->cookie_offset); + cookie = ldl_be_p(buf + s->cookie_offset) & 0xffffffffULL; } if (cookie != s->rx_cookie) { if (!s->header_mismatch) { -- cgit v1.2.3