anchao opened a new pull request, #20885:
URL: https://github.com/apache/nuttx/pull/20885
## Summary
Harden the IPv6 receive path against malformed extension-header chains.
The IPv6 input path already validates the IPv6 payload length against the
received device buffer, but the extension-header loop did not validate each
header against the remaining packet length before dereferencing or
advancing.
A remote peer could advertise an oversized extension header length and cause
the next loop iteration to read the next-header and length fields past the
received packet buffer.
## Changes
- Check that the fixed IPv6 extension-header prefix is present before
reading it.
- Check that the computed extension-header length fits in the remaining
packet.
- Drop malformed or truncated extension-header chains through the existing
drop path.
## Testing
sim/ipforward
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
