Most in-kernel BPF interpreters have the constant field of an

instruction as an unsigned value, and, at least for comparisons, the
value is converted to unsigned anyway, as the A and X registers are
unsigned, and the Usual Arithmetic Conversions of C89 apply to
comparisons.  Make ours unsigned as well.  (On two's complement machines
- which means all machines we support - that won't be an issue for using
the constant field as an offset, either, as arithmetic in the BPF
virtual machine is 32-bit two's complement.)

1 files changed, 2 insertions, 2 deletions

diff --git a/pcap-bpf.h b/pcap-bpf.h
index 3e830838..9887330a 100644
--- a/pcap-bpf.h
+++ b/pcap-bpf.h
@@ -37,7 +37,7 @@
  *
  *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
  *
- * @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.38 2005-05-27 23:32:20 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.39 2005-08-01 01:13:53 guy Exp $ (LBL)
  */
 
 /*
@@ -656,7 +656,7 @@ struct bpf_insn {
 	u_short	code;
 	u_char 	jt;
 	u_char 	jf;
-	bpf_int32 k;
+	bpf_u_int32 k;
 };
 
 /*