diff --git a/CHANGELOG b/CHANGELOG index 5d5f81ad..e113c2ad 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -6,6 +6,11 @@ HISTORY * [Enter new changes just after this line - do not remove this line] + ++ Bugfixes: + + 2023-09-28: Erik Ekman + * Fix ND6 Router Advertisement parsing when NETIF_MAX_HWADDR_LEN is above 6. + (STABLE-2.2.0): 2018-10-02: Dirk Ziegelmeier diff --git a/src/core/ipv6/nd6.c b/src/core/ipv6/nd6.c index 3b13c21e..c566c572 100644 --- a/src/core/ipv6/nd6.c +++ b/src/core/ipv6/nd6.c @@ -687,11 +687,12 @@ nd6_input(struct pbuf *p, struct netif *inp) case ND6_OPTION_TYPE_SOURCE_LLADDR: { struct lladdr_option *lladdr_opt; - if (option_len < sizeof(struct lladdr_option)) { + if (option_len < ND6_LLADDR_OPTION_MIN_LENGTH) { goto lenerr_drop_free_return; } lladdr_opt = (struct lladdr_option *)buffer; - if ((default_router_list[i].neighbor_entry != NULL) && + if ((lladdr_opt->length == inp->hwaddr_len) && + (default_router_list[i].neighbor_entry != NULL) && (default_router_list[i].neighbor_entry->state == ND6_INCOMPLETE)) { SMEMCPY(default_router_list[i].neighbor_entry->lladdr, lladdr_opt->addr, inp->hwaddr_len); default_router_list[i].neighbor_entry->state = ND6_REACHABLE; diff --git a/src/include/lwip/prot/nd6.h b/src/include/lwip/prot/nd6.h index c270d07c..a92d34d9 100644 --- a/src/include/lwip/prot/nd6.h +++ b/src/include/lwip/prot/nd6.h @@ -153,6 +153,7 @@ PACK_STRUCT_END /** Link-layer address option. */ #define ND6_OPTION_TYPE_SOURCE_LLADDR (0x01) #define ND6_OPTION_TYPE_TARGET_LLADDR (0x02) +#define ND6_LLADDR_OPTION_MIN_LENGTH (2) #ifdef PACK_STRUCT_USE_INCLUDES # include "arch/bpstruct.h" #endif