diff options
| author | Chris Leech <cleech@redhat.com> | 2019-10-31 15:17:43 -0700 |
|---|---|---|
| committer | Chris Leech <cleech@redhat.com> | 2019-10-31 15:48:08 -0700 |
| commit | af48f0d68db48cd492d0e27e046fc011be236fd3 (patch) | |
| tree | 0add959b5ecc20ff297177dac4553de0eb7a0ce2 | |
| parent | 504b990bc886d708ae673ac1fa0e09e7911c2823 (diff) | |
| download | open-iscsi-af48f0d68db48cd492d0e27e046fc011be236fd3.tar.gz | |
Out-of-bounds read: Overrunning array of 8 2-byte elements
This loop is executing 16 times (sizeof(struct ipv6_addr)) but then
consumes 16-bits at a time (and moves ptr ahead two bytes).
| -rw-r--r-- | iscsiuio/src/uip/ipv6.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c index 05efa73..5710199 100644 --- a/iscsiuio/src/uip/ipv6.c +++ b/iscsiuio/src/uip/ipv6.c @@ -521,7 +521,7 @@ static void ipv6_insert_protocol_chksum(struct ipv6_hdr *ipv6) sum = 0; ptr = (u16_t *)&ipv6->ipv6_src; - for (i = 0; i < sizeof(struct ipv6_addr); i++) { + for (i = 0; i < sizeof(struct ipv6_addr); i += 2) { sum += HOST_TO_NET16(*ptr); ptr++; } |