net/lwip : ND6 Redirect, add checking routine for invalid option field
This commit is patch to add checking routine for invalid option field
- only either target address or redirected option is valid on redirect
- other field should be ignored and do not process it
@@ -920,13 +920,14 @@ void nd6_input(struct pbuf *p, struct netif *inp)
if (redir_optlen >= 2) {
buffer = ((u8_t *)p->payload + sizeof(struct redirect_header));
while (!redirected_opt && redir_optlen >= 2) {
- switch (buffer[0]) {
- case ND6_OPTION_TYPE_TARGET_LLADDR :
if (buffer[1] == 0) { /* Invalid length */
pbuf_free(p);
ND6_STATS_INC(nd6.drop);
return;
- } else if (buffer[1] == 1) { /* IEEE 802 Link Layer Address */
+ }
+ switch (buffer[0]) {
+ case ND6_OPTION_TYPE_TARGET_LLADDR:
+ if (buffer[1] == 1) { /* IEEE 802 Link Layer Address */
lladdr_opt = (struct lladdr_option *)buffer;
offset = sizeof(struct lladdr_option);
} else {
@@ -939,8 +940,7 @@ void nd6_input(struct pbuf *p, struct netif *inp)
offset = sizeof(struct redirected_header_option);
break;
default:
- /* @todo Considering Link-layer address is not IEEE 802 */
- offset = sizeof(struct lladdr_option);
+ offset = (buffer[1] << 3);
break;
}
redir_optlen -= offset;
