From b6e85f802da204424aad2fa6a4ece29356fa80d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Sun, 29 Nov 2020 19:58:43 +0100 Subject: [PATCH] ipv4 & ipv6: remove_trailer() uses a positive size as parameter Change-Id: Id7d009cfee7727afb8267703c22c467e5f636070 Reviewed-on: https://review.haiku-os.org/c/haiku/+/3438 Reviewed-by: Adrien Destugues --- src/add-ons/kernel/network/protocols/ipv4/ipv4.cpp | 6 +++--- src/add-ons/kernel/network/protocols/ipv6/ipv6.cpp | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/add-ons/kernel/network/protocols/ipv4/ipv4.cpp b/src/add-ons/kernel/network/protocols/ipv4/ipv4.cpp index 8074113fbe..7275419f83 100644 --- a/src/add-ons/kernel/network/protocols/ipv4/ipv4.cpp +++ b/src/add-ons/kernel/network/protocols/ipv4/ipv4.cpp @@ -311,9 +311,9 @@ FragmentPacket::AddFragment(uint16 start, uint16 end, net_buffer* buffer, gBufferModule->remove_header(buffer, previous->fragment.end - start); start = previous->fragment.end; } - if (next != NULL && next->fragment.start < end) { - TRACE(" remove trailer %d bytes", next->fragment.start - end); - gBufferModule->remove_trailer(buffer, next->fragment.start - end); + if (next != NULL && end > next->fragment.start) { + TRACE(" remove trailer %d bytes", end - next->fragment.start); + gBufferModule->remove_trailer(buffer, end - next->fragment.start); end = next->fragment.start; } diff --git a/src/add-ons/kernel/network/protocols/ipv6/ipv6.cpp b/src/add-ons/kernel/network/protocols/ipv6/ipv6.cpp index 444e1082be..f9184219a8 100644 --- a/src/add-ons/kernel/network/protocols/ipv6/ipv6.cpp +++ b/src/add-ons/kernel/network/protocols/ipv6/ipv6.cpp @@ -350,9 +350,9 @@ FragmentPacket::AddFragment(uint16 start, uint16 end, net_buffer* buffer, gBufferModule->remove_header(buffer, previous->fragment.end - start); start = previous->fragment.end; } - if (next != NULL && next->fragment.start < end) { - TRACE(" remove trailer %d bytes", next->fragment.start - end); - gBufferModule->remove_trailer(buffer, next->fragment.start - end); + if (next != NULL && end > next->fragment.start) { + TRACE(" remove trailer %d bytes", end - next->fragment.start); + gBufferModule->remove_trailer(buffer, end - next->fragment.start); end = next->fragment.start; }