From 5c945a0b4891a20deeb023b3bd40dee5dda1aaff Mon Sep 17 00:00:00 2001 From: cinap_lenrek Date: Mon, 27 Aug 2018 20:58:48 +0200 Subject: devip: fix router adv/sol options validation (options padded to 8 bytes) --- sys/src/9/ip/icmp6.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/src/9/ip/icmp6.c b/sys/src/9/ip/icmp6.c index bceb6aeff..b814070de 100644 --- a/sys/src/9/ip/icmp6.c +++ b/sys/src/9/ip/icmp6.c @@ -617,7 +617,7 @@ valid(Proto *icmp, Ipifc *ifc, Block *bp, Icmppriv6 *ipriv) goto err; } sz = IPICMPSZ + 8; - while (sz+1 < pktsz) { + while (sz+8 <= pktsz) { osz = packet[sz+1]; if(osz <= 0) { ipriv->stats[OptlenErrs6]++; @@ -634,7 +634,7 @@ valid(Proto *icmp, Ipifc *ifc, Block *bp, Icmppriv6 *ipriv) } unsp = (ipcmp(p->src, v6Unspecified) == 0); sz = IPICMPSZ + 8; - while (sz+1 < pktsz) { + while (sz+8 <= pktsz) { osz = packet[sz+1]; if(osz <= 0 || (unsp && packet[sz] == SRC_LLADDR)) { -- cgit v1.2.3