Skip to content

Commit d718b46

Browse files
jukkarkartben
authored andcommitted
net: ipv6: Do not access link address past array length
It is possible to manually set link address length past 6 at runtime and trying to check IPv6 ll address that way. This should fail as we could read two bytes past the address buffer. Coverity-CID: 516242 Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
1 parent e44ed8d commit d718b46

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

include/zephyr/net/net_ip.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1536,6 +1536,10 @@ static inline bool net_ipv6_addr_based_on_ll(const struct in6_addr *addr,
15361536

15371537
break;
15381538
case 8:
1539+
if (sizeof(lladdr->addr) < 8) {
1540+
return false;
1541+
}
1542+
15391543
if (!memcmp(&addr->s6_addr[9], &lladdr->addr[1],
15401544
lladdr->len - 1) &&
15411545
(addr->s6_addr[8] ^ 0x02) == lladdr->addr[0]) {

0 commit comments

Comments
 (0)