Fri, May 31, 2024 at 03:14:32PM CEST, liuhangbin@gmail.com wrote:
RFC 4191 specifies that the Route Information Option Length should be 1, 2, or 3, depending on the Prefix Length. A malicious packet can potentially trigger a buffer overflow and crash the tool by sending an IPv6 router advertisement message containing the "Route Information" option with a "Length" field larger than 3. To address this, add a check on the length field. If the length is incorrect, the system should return a zero address.
Reported-by: evverx@gmail.com
A name please?
Signed-off-by: Hangbin Liu liuhangbin@gmail.com
libndp/libndp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libndp/libndp.c b/libndp/libndp.c index 6314717df3ab..f3743e24cc39 100644 --- a/libndp/libndp.c +++ b/libndp/libndp.c @@ -1618,7 +1618,8 @@ struct in6_addr *ndp_msg_opt_route_prefix(struct ndp_msg *msg, int offset) ndp_msg_payload_opts_offset(msg, offset);
memset(&prefix, 0, sizeof(prefix));
- memcpy(&prefix, &ri->nd_opt_ri_prefix, (ri->nd_opt_ri_len - 1) << 3);
- if (ri->nd_opt_ri_len <= 3)
memcpy(&prefix, &ri->nd_opt_ri_prefix, (ri->nd_opt_ri_len - 1) << 3);
Wouldn't it be better to use max() ?
return &prefix; }
-- 2.43.0