From d3f19a3851aabbde80ac27111b3de056a9974012 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Fri, 20 May 2011 17:23:35 +0200
Subject: [PATCH] Fix memcmp checks that prevent reading past buffer boundary.

---
 src/util-memcmp.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/util-memcmp.h b/src/util-memcmp.h
index 48a7f62a58..5424412c04 100644
--- a/src/util-memcmp.h
+++ b/src/util-memcmp.h
@@ -140,7 +140,7 @@ static inline int SCMemcmp(void *s1, void *s2, size_t len) {
     do {
         /* apparently we can't just read 16 bytes even though
          * it almost always works fine :) */
-        if (likely(len + offset < 16)) {
+        if (likely(len - offset < 16)) {
             return memcmp(s1, s2, len - offset) ? 1 : 0;
         }
 
@@ -188,7 +188,7 @@ static inline int SCMemcmpLowercase(void *s1, void *s2, size_t len) {
     do {
         /* apparently we can't just read 16 bytes even though
          * it almost always works fine :) */
-        if (likely(len + offset < 16)) {
+        if (likely(len - offset < 16)) {
             return MemcmpLowercase(s1, s2, len - offset);
         }
 
@@ -248,7 +248,7 @@ static inline int SCMemcmp(void *s1, void *s2, size_t len) {
     do {
         /* apparently we can't just read 16 bytes even though
          * it almost always works fine :) */
-        if (likely(len + offset < 16)) {
+        if (likely(len - offset < 16)) {
             return memcmp(s1, s2, len - offset) ? 1 : 0;
         }
 
@@ -296,7 +296,7 @@ static inline int SCMemcmpLowercase(void *s1, void *s2, size_t len) {
     do {
         /* apparently we can't just read 16 bytes even though
          * it almost always works fine :) */
-        if (likely(len + offset < 16)) {
+        if (likely(len - offset < 16)) {
             return MemcmpLowercase(s1, s2, len - offset);
         }