Sometimes a nullpointer dereferencing occurs because of using a wrong
pointer arithmetic in udp_uncompression.

This patch changes "**(hc06_ptr + 3)" to the right one "*(*hc06_ptr +
3)". Dereferencing like "**(hc06_ptr + 3)" works in a random case only.

Signed-off-by: Alexander Aring <alex.ar...@gmail.com>
---
 net/ieee802154/6lowpan_iphc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/ieee802154/6lowpan_iphc.c b/net/ieee802154/6lowpan_iphc.c
index 88e7da5..8bbe28e 100644
--- a/net/ieee802154/6lowpan_iphc.c
+++ b/net/ieee802154/6lowpan_iphc.c
@@ -548,7 +548,7 @@ static void compress_udp_header(u8 **hc06_ptr, struct 
sk_buff *skb)
                                LOWPAN_NHC_UDP_4BIT_PORT)) {
                pr_debug("UDP header: both ports compression to 4 bits\n");
                **hc06_ptr = LOWPAN_NHC_UDP_CS_P_11;
-               **(hc06_ptr + 1) = /* subtraction is faster */
+               *(*hc06_ptr + 1) = /* subtraction is faster */
                   (u8)((uh->dest - LOWPAN_NHC_UDP_4BIT_PORT) +
                       ((uh->source & LOWPAN_NHC_UDP_4BIT_PORT) << 4));
                *hc06_ptr += 2;
@@ -557,14 +557,14 @@ static void compress_udp_header(u8 **hc06_ptr, struct 
sk_buff *skb)
                pr_debug("UDP header: remove 8 bits of dest\n");
                **hc06_ptr = LOWPAN_NHC_UDP_CS_P_01;
                memcpy(*hc06_ptr + 1, &uh->source, 2);
-               **(hc06_ptr + 3) = (u8)(uh->dest - LOWPAN_NHC_UDP_8BIT_PORT);
+               *(*hc06_ptr + 3) = (u8)(uh->dest - LOWPAN_NHC_UDP_8BIT_PORT);
                *hc06_ptr += 4;
        } else if ((uh->source & LOWPAN_NHC_UDP_8BIT_MASK) ==
                        LOWPAN_NHC_UDP_8BIT_PORT) {
                pr_debug("UDP header: remove 8 bits of source\n");
                **hc06_ptr = LOWPAN_NHC_UDP_CS_P_10;
                memcpy(*hc06_ptr + 1, &uh->dest, 2);
-               **(hc06_ptr + 3) = (u8)(uh->source - LOWPAN_NHC_UDP_8BIT_PORT);
+               *(*hc06_ptr + 3) = (u8)(uh->source - LOWPAN_NHC_UDP_8BIT_PORT);
                *hc06_ptr += 4;
        } else {
                pr_debug("UDP header: can't compress\n");
-- 
1.8.5.1


------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
Linux-zigbee-devel mailing list
Linux-zigbee-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-zigbee-devel

Reply via email to