This is an automated email from the ASF dual-hosted git repository.
michallenc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new d6a5b19ce90 net/ipv6: validate extension header bounds
d6a5b19ce90 is described below
commit d6a5b19ce90f0c19d5318055c1cebfb9186660a4
Author: chao an <[email protected]>
AuthorDate: Thu Oct 22 22:29:53 2026 +0800
net/ipv6: validate extension header bounds
The IPv6 input path validated the packet payload length against the
received buffer before walking extension headers, but the extension-header
loop did not validate each header against the remaining packet length.
A remote peer could advertise an oversized extension header length and
cause the next loop iteration to read the next-header and length fields
past the received packet buffer.
Validate that the fixed extension-header prefix is present before
dereferencing it, and validate that the computed extension-header length
fits within the received packet before advancing to the next header.
Signed-off-by: chao an <[email protected]>
---
net/devif/ipv6_input.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/devif/ipv6_input.c b/net/devif/ipv6_input.c
index 87067bcf367..bb124af22f1 100644
--- a/net/devif/ipv6_input.c
+++ b/net/devif/ipv6_input.c
@@ -322,6 +322,12 @@ static int ipv6_in(FAR struct net_driver_s *dev)
FAR struct ipv6_extension_s *exthdr;
uint16_t extlen;
+ if (sizeof(struct ipv6_extension_s) > dev->d_len - iphdrlen)
+ {
+ nwarn("WARNING: Extension header truncated\n");
+ goto drop;
+ }
+
/* Just skip over the extension header */
exthdr = (FAR struct ipv6_extension_s *)payload;
@@ -337,6 +343,12 @@ static int ipv6_in(FAR struct net_driver_s *dev)
extlen = EXTHDR_LEN((unsigned int)exthdr->len);
}
+ if (extlen > dev->d_len - iphdrlen)
+ {
+ nwarn("WARNING: Extension header exceeds packet length\n");
+ goto drop;
+ }
+
payload += extlen;
iphdrlen += extlen;
nxthdr = exthdr->nxthdr;
