Prevent a possible read out of bounds in the processing of IPv6 extension headers.
@@ -118,6 +118,9 @@ uipbuf_get_next_header(uint8_t *buffer, uint16_t size, uint8_t *protocol, bool s
/* Check if the buffer is large enough for the next header */
if(uip_is_proto_ext_hdr(*protocol)) {
+ if(curr_hdr_len + sizeof(struct uip_ext_hdr) > size) {
+ return NULL;
+ }
next_ext = (struct uip_ext_hdr *)next_header;
next_hdr_len = (next_ext->len << 3) + 8;
} else {
