From efa4cea1beec1fa758ac94f350dfa7bdfa6d472f Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Sun, 12 Jul 2026 23:12:03 +0300 Subject: ipdb: fix undefined shift in build_ip6_addr() host-bits mask For prefix lengths 65..127 the mask for the host bits was built with (1 << (128 - prefix_len)) - 1 using a plain int literal, which is undefined behavior for shift counts of 31 and above, i.e. for any prefix length from 65 to 97. Use a 64-bit constant for the shift. --- accel-pppd/ipdb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/accel-pppd/ipdb.c b/accel-pppd/ipdb.c index dd8c61c9..8fc08063 100644 --- a/accel-pppd/ipdb.c +++ b/accel-pppd/ipdb.c @@ -83,7 +83,10 @@ void __export build_ip6_addr(struct ipv6db_addr_t *a, uint64_t intf_id, struct i if (a->prefix_len <= 64) *(uint64_t *)(addr->s6_addr + 8) = intf_id; else - *(uint64_t *)(addr->s6_addr + 8) |= intf_id & htobe64((1 << (128 - a->prefix_len)) - 1); + /* prefix_len 65..127 means a shift of up to 63 bits: a plain + * int literal 1 is undefined behavior for shifts >= 31, so the + * host bits mask must be built from a 64-bit constant */ + *(uint64_t *)(addr->s6_addr + 8) |= intf_id & htobe64((UINT64_C(1) << (128 - a->prefix_len)) - 1); } -- cgit v1.2.3