giomba/nes-proj
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Extend 8-bit variables to 16 bits to avoid integer overflows when processing IPv6 extension header options.

Browse Source
This commit is contained in:
Nicolas Tsiftes 2019-01-08 10:19:08 +01:00
parent 5a974a21ba
commit f1b2d35a8c
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
os/net/ipv6/uip6.c
View File

@ -824,13 +824,13 @@ ext_hdr_options_process(uint8_t *ext_buf)
* 8 bytes, excluding the first 8 bytes
* length field in an option : the length of data in the option
*/
uint8_t opt_offset = 2; /* 2 first bytes in ext header */
uint16_t opt_offset = 2; /* 2 first bytes in ext header */
struct uip_hbho_hdr *ext_hdr = (struct uip_hbho_hdr *)ext_buf;
uint8_t ext_hdr_len = (ext_hdr->len << 3) + 8;
uint16_t ext_hdr_len = (ext_hdr->len << 3) + 8;
while(opt_offset + 2 <= ext_hdr_len) { /* + 2 for opt header */
struct uip_ext_hdr_opt *opt_hdr = (struct uip_ext_hdr_opt *)(ext_buf + opt_offset);
uint8_t opt_len = opt_hdr->len + 2;
uint16_t opt_len = opt_hdr->len + 2;
if(opt_offset + opt_len > ext_hdr_len) {
LOG_ERR("RPL Option too long: Dropping Packet\n");