nd6: Fix RA link-local address option length check

Length field is in units of 8 bytes.
This commit is contained in:
Erik Ekman 2023-09-28 22:33:41 +02:00
parent 2159f84682
commit 6f700a157d

View File

@ -687,12 +687,11 @@ nd6_input(struct pbuf *p, struct netif *inp)
case ND6_OPTION_TYPE_SOURCE_LLADDR:
{
struct lladdr_option *lladdr_opt;
if (option_len < ND6_LLADDR_OPTION_MIN_LENGTH) {
if (option_len < (ND6_LLADDR_OPTION_MIN_LENGTH + inp->hwaddr_len)) {
goto lenerr_drop_free_return;
}
lladdr_opt = (struct lladdr_option *)buffer;
if ((lladdr_opt->length == inp->hwaddr_len) &&
(default_router_list[i].neighbor_entry != NULL) &&
if ((default_router_list[i].neighbor_entry != NULL) &&
(default_router_list[i].neighbor_entry->state == ND6_INCOMPLETE)) {
SMEMCPY(default_router_list[i].neighbor_entry->lladdr, lladdr_opt->addr, inp->hwaddr_len);
default_router_list[i].neighbor_entry->state = ND6_REACHABLE;