From 42eead8f414e9673574f7594271558d8a5fa6889 Mon Sep 17 00:00:00 2001
From: fbernon <fbernon>
Date: Thu, 26 Jul 2007 17:10:56 +0000
Subject: [PATCH] igmp.c: Fix bug #20595 to accept IGMPv3 "Query" messages.

---
 CHANGELOG            |  3 +++
 src/core/ipv4/igmp.c | 15 +++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5437417e..472aad7d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -256,6 +256,9 @@ HISTORY
 
   ++ Bug fixes:
 
+  2007-07-26 Frédéric Bernon (and "thedoctor")
+  * igmp.c: Fix bug #20595 to accept IGMPv3 "Query" messages.
+
   2007-07-25 Simon Goldschmidt
   * api_msg.c, tcp.c: Another fix for bug #20021: by not returning an error if
     tcp_output fails in tcp_close, the code in do_close_internal gets simpler
diff --git a/src/core/ipv4/igmp.c b/src/core/ipv4/igmp.c
index bc05f454..26eef965 100644
--- a/src/core/ipv4/igmp.c
+++ b/src/core/ipv4/igmp.c
@@ -209,21 +209,20 @@ igmp_input(struct pbuf *p, struct netif *inp, struct ip_addr *dest)
   struct igmp_group* group;
   struct igmp_group* groupref;
 
-  iphdr = p->payload;  
-  igmp  = (struct igmpmsg *)(((u8_t *)p->payload)+((u32_t)(IPH_HL(iphdr) * 4)));
-
-  LWIP_DEBUGF(IGMP_DEBUG, ("igmp message to address %l \n", (long)dest->addr));
-
-  if (p->len < IGMP_MINLEN) {
-    /* Note that the length CAN be greater than 8 but only 8 are used - All are included in the checksum */
+  /* Note that the length CAN be greater than 8 but only 8 are used - All are included in the checksum */    
+  iphdr = p->payload;
+  if (pbuf_header(p, -(IPH_HL(iphdr) * 4)) || (p->len < IGMP_MINLEN)) {
     pbuf_free(p);
     igmpstats.igmp_length_err++;
     LWIP_DEBUGF(IGMP_DEBUG, ("igmp.c,Line %x igmp length error\n", __LINE__));
     return;
   }
 
+  LWIP_DEBUGF(IGMP_DEBUG, ("igmp message to address %l \n", (long)dest->addr));
+
   /* Now calculate and check the checksum */
-  if (inet_chksum(igmp, IGMP_MINLEN /*p->len*/)) {
+  igmp = (struct igmpmsg *)p->payload;
+  if (inet_chksum(igmp, p->len)) {
     pbuf_free(p);
     igmpstats.igmp_checksum_err++;
     LWIP_DEBUGF(IGMP_DEBUG, ("igmp.c,Line %d igmp checksum error\n", __LINE__));