Wed, Jun 05, 2024 at 05:57:43AM CEST, liuhangbin@gmail.com wrote:
RFC 4191 specifies that the Route Information Option Length should be 1, 2, or 3, depending on the Prefix Length. A malicious node could potentially trigger a buffer overflow and crash the tool by sending an IPv6 router advertisement message containing the "Route Information" option with a "Length" field larger than 3.
To address this, add a check on the length field.
Fixes: 8296a5bf0755 ("add support for Route Information Option (rfc4191)") Reported-by: Evgeny Vereshchagin evverx@gmail.com Suggested-by: Felix Maurer fmaurer@redhat.com Signed-off-by: Hangbin Liu liuhangbin@gmail.com
Applied, thanks!