Commit 288ce357 authored by Olaf Kirch's avatar Olaf Kirch Committed by David S. Miller

[NETFILTER]: Fix pointer deref'ing in ip6t_LOG.c

Signed-off-by: default avatarOlaf Kirch <okir@suse.de>
Signed-off-by: default avatarDavid S. Miller <davem@redhat.com>
parent 0bfcccd1
...@@ -61,7 +61,7 @@ static u_int8_t ip6_nexthdr(u_int8_t currenthdr, u_int8_t **hdrptr) ...@@ -61,7 +61,7 @@ static u_int8_t ip6_nexthdr(u_int8_t currenthdr, u_int8_t **hdrptr)
repeatedly...with a large stick...no, an even LARGER repeatedly...with a large stick...no, an even LARGER
stick...no, you're still not thinking big enough */ stick...no, you're still not thinking big enough */
nexthdr = **hdrptr; nexthdr = **hdrptr;
hdrlen = *hdrptr[1] * 4 + 8; hdrlen = (*hdrptr)[1] * 4 + 8;
*hdrptr = *hdrptr + hdrlen; *hdrptr = *hdrptr + hdrlen;
break; break;
/*stupid rfc2402 */ /*stupid rfc2402 */
...@@ -69,7 +69,7 @@ static u_int8_t ip6_nexthdr(u_int8_t currenthdr, u_int8_t **hdrptr) ...@@ -69,7 +69,7 @@ static u_int8_t ip6_nexthdr(u_int8_t currenthdr, u_int8_t **hdrptr)
case IPPROTO_ROUTING: case IPPROTO_ROUTING:
case IPPROTO_HOPOPTS: case IPPROTO_HOPOPTS:
nexthdr = **hdrptr; nexthdr = **hdrptr;
hdrlen = *hdrptr[1] * 8 + 8; hdrlen = (*hdrptr)[1] * 8 + 8;
*hdrptr = *hdrptr + hdrlen; *hdrptr = *hdrptr + hdrlen;
break; break;
case IPPROTO_FRAGMENT: case IPPROTO_FRAGMENT:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment