From 161c4fa2ce7b2d39028d4b3ee519a638784363fa Mon Sep 17 00:00:00 2001 From: Greg Steinbrecher Date: Thu, 4 Nov 2021 00:55:07 +0000 Subject: [PATCH] internet: read correct bits when deserializing IPv6 flow label On line 153, `m_flowLabel` is OR-ed into the LSBs of `vTcFl`, which is then written with `WriteHtonU32` into the buffer. On line 169, `vTcFl` is read out using `ReadNtohU32`, so the byte order should be the same as it was on line 153. However, currently `m_flowLabel` is being assigned the value of `vTcFl` masked by `0xfff00000`. This commit changes line 177 to read the correct set of 20 bits to recover the original flow label. One question: Right now, `SetFlowLabel` (and the other setters) don't check that the value is in range, and Serialize doesn't mask them. Should this be fixed? Right now, a large flow label would clobber the traffic class and version fields. --- src/internet/model/ipv6-header.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/internet/model/ipv6-header.cc b/src/internet/model/ipv6-header.cc index ed46ef8f2..ef5730f2a 100644 --- a/src/internet/model/ipv6-header.cc +++ b/src/internet/model/ipv6-header.cc @@ -194,7 +194,7 @@ uint32_t Ipv6Header::Deserialize (Buffer::Iterator start) } m_trafficClass = (uint8_t)((vTcFl >> 20) & 0x000000ff); - m_flowLabel = vTcFl & 0xfff00000; + m_flowLabel = vTcFl & 0xfffff; m_payloadLength = i.ReadNtohU16 (); m_nextHeader = i.ReadU8 (); m_hopLimit = i.ReadU8 ();