• Sven Eckelmann's avatar
    batman-adv: Fix invalid read while copying bat_iv.bcast_own · 13bbdd37
    Sven Eckelmann authored
    batadv_iv_ogm_orig_del_if removes a part of the bcast_own which previously
    belonged to the now removed interface. This is done by copying all data
    which comes before the removed interface and then appending all the data
    which comes after the removed interface.
    
    The address calculation for the position of the data which comes after the
    removed interface assumed that the bat_iv.bcast_own is a pointer to a
    single byte datatype. But it is a pointer to unsigned long and thus the
    calculated position was wrong off factor sizeof(unsigned long).
    
    Fixes: 83a8342678a0 ("more basic routing code added (forwarding packets /
    bitarray added)")
    Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
    Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
    Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
    13bbdd37
bat_iv_ogm.c 59.3 KB