Validate the length in the DIO prefix info option.
@@ -447,6 +447,14 @@ dio_input(void)
goto discard;
}
dio.prefix_info.length = buffer[i + 2];
+
+ if(dio.prefix_info.length > sizeof(uip_ipaddr_t) * 8) {
+ LOG_WARN("Invalid DAG prefix info, len %u > %u\n",
+ dio.prefix_info.length, (unsigned)(sizeof(uip_ipaddr_t) * 8));
+ RPL_STAT(rpl_stats.malformed_msgs++);
+ goto discard;
+ }
+
dio.prefix_info.flags = buffer[i + 3];
/* valid lifetime is ingnored for now - at i + 4 */
/* preferred lifetime stored in lifetime */
