[patch] Proposed/Tested patch by Pax team

pax-overflow2.patch (text/plain), 514 bytes, created by Alexander Wetzel on 2016-10-23 16:46:01 UTC

--- a/net/ipv6/reassembly.c	2016-10-22 14:26:32.850398440 +0200
+++ b/net/ipv6/reassembly.c	2016-10-23 17:23:42.215018111 +0200
@@ -219,8 +219,8 @@
 		goto err;
 
 	offset = ntohs(fhdr->frag_off) & ~0x7;
-	end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
-			((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
+	end = offset + ntohs(ipv6_hdr(skb)->payload_len);
+	end -= (u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1);
 
 	if ((unsigned int)end > IPV6_MAXPLEN) {
 		__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),