diff options
| author | Nathaniel Ferguson <nathaniel@leapfrog.foundation> | 2020-05-03 03:17:46 -0400 |
|---|---|---|
| committer | Tobias Klauser <tklauser@distanz.ch> | 2020-05-04 14:09:51 +0200 |
| commit | 3e69db49e3c0b8e59c80782e6bad3b02336a28d2 (patch) | |
| tree | ac3a8b0c9f95c50d22e28fbef658c8c80e67888d /proto_lldp.c | |
| parent | a8c3c53c271b21878ea7c1c083bb5abfd634bb41 (diff) | |
proto_lldp: fix pointer increment in LLDP_TLV_SYSTEM_CAP case
Fixed a typo wherein a pointer was incremented by sizeof(uint32_t) after
reading sizeof(uint16_t) and before reading another sizeof(uint16_t). In
essence a potential out of bounds memory access (read) due to improper
increment of pointer
Signed-off-by: Nathaniel Ferguson <nathaniel@leapfrog.foundation>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Diffstat (limited to 'proto_lldp.c')
| -rw-r--r-- | proto_lldp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/proto_lldp.c b/proto_lldp.c index 1640d19..889169a 100644 --- a/proto_lldp.c +++ b/proto_lldp.c @@ -356,7 +356,7 @@ static void lldp(struct pkt_buff *pkt) goto out_invalid; sys_cap = EXTRACT_16BIT(tlv_info_str); - tlv_info_str += sizeof(uint32_t); + tlv_info_str += sizeof(uint16_t); en_cap = EXTRACT_16BIT(tlv_info_str); tprintf(" ("); |