From f1b2d35a8c297489bb44489baeb6ada976dd916d Mon Sep 17 00:00:00 2001 From: Nicolas Tsiftes Date: Tue, 8 Jan 2019 10:19:08 +0100 Subject: [PATCH] Extend 8-bit variables to 16 bits to avoid integer overflows when processing IPv6 extension header options. --- os/net/ipv6/uip6.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/os/net/ipv6/uip6.c b/os/net/ipv6/uip6.c index 8a1c27682..24274a306 100644 --- a/os/net/ipv6/uip6.c +++ b/os/net/ipv6/uip6.c @@ -824,13 +824,13 @@ ext_hdr_options_process(uint8_t *ext_buf) * 8 bytes, excluding the first 8 bytes * length field in an option : the length of data in the option */ - uint8_t opt_offset = 2; /* 2 first bytes in ext header */ + uint16_t opt_offset = 2; /* 2 first bytes in ext header */ struct uip_hbho_hdr *ext_hdr = (struct uip_hbho_hdr *)ext_buf; - uint8_t ext_hdr_len = (ext_hdr->len << 3) + 8; + uint16_t ext_hdr_len = (ext_hdr->len << 3) + 8; while(opt_offset + 2 <= ext_hdr_len) { /* + 2 for opt header */ struct uip_ext_hdr_opt *opt_hdr = (struct uip_ext_hdr_opt *)(ext_buf + opt_offset); - uint8_t opt_len = opt_hdr->len + 2; + uint16_t opt_len = opt_hdr->len + 2; if(opt_offset + opt_len > ext_hdr_len) { LOG_ERR("RPL Option too long: Dropping Packet\n");