net: ipv6: Check sub-option length

Make sure that the extension, like HBHO, sub-option length is not too large. Fixes zephyrproject-rtos#16323 Signed-off-by: Jukka Rissanen <[email protected]>
bseazeng · Aug 27, 2019 · 0049c52 · 0049c52
1 parent b763a9b
commit 0049c52
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/subsys/net/ip/ipv6.c b/subsys/net/ip/ipv6.c
@@ -218,6 +218,16 @@ static inline int ipv6_handle_ext_hdr_options(struct net_pkt *pkt,
 
 			break;
 		default:
+			/* Make sure that the option length is not too large.
+			 * The former 1 + 1 is the length of extension type +
+			 * length fields.
+			 * The latter 1 + 1 is the length of the sub-option
+			 * type and length fields.
+			 */
+			if (opt_len > (exthdr_len - (1 + 1 + 1 + 1))) {
+				return -EINVAL;
+			}
+
 			if (ipv6_drop_on_unknown_option(pkt, hdr,
 							opt_type, length)) {
 				return -ENOTSUP;