commit a6932d2eae39d775425783a14905447c5a1fc737
author Harald Welte <laforge@gnumonks.org> Mon May 31 11:02:57 2010 +0200
committer Harald Welte <laforge@gnumonks.org> Mon May 31 11:02:57 2010 +0200
tree 4e76479a518aff64d4407d38340c535757092970
parent 02ea86fa718714684d0dc24b512747e0c4269a67

[GPRS] NS: Fix GRE keepalive response in FR-GRE encapsulation

openbsc/src/gprs/gprs_ns_frgre.c

diff --git a/openbsc/src/gprs/gprs_ns_frgre.c b/openbsc/src/gprs/gprs_ns_frgre.c
index 326bd70..7436d0d 100644
--- a/openbsc/src/gprs/gprs_ns_frgre.c
+++ b/openbsc/src/gprs/gprs_ns_frgre.c
@@ -62,7 +62,7 @@
 
 	gre_payload_len = msg->len - (iph->ihl*4 + sizeof(*greh));
 
-	inner_iph = (struct iphdr *) (uint8_t *)greh + sizeof(*greh);
+	inner_iph = (struct iphdr *) ((uint8_t *)greh + sizeof(*greh));
 
 	if (gre_payload_len < inner_iph->ihl*4 + sizeof(*inner_greh)) {
 		LOGP(DNS, LOGL_ERROR, "GRE keepalive too short\n");
@@ -81,7 +81,7 @@
 		return -EIO;
 	}
 
-	inner_greh = (struct gre_hdr *) ((uint8_t *)iph + iph->ihl*4);
+	inner_greh = (struct gre_hdr *) ((uint8_t *)inner_iph + iph->ihl*4);
 	if (inner_greh->ptype != htons(GRE_PTYPE_KAR)) {
 		LOGP(DNS, LOGL_ERROR, "GRE keepalive inner GRE type != 0\n");
 		return -EIO;