View | Details | Raw Unified | Return to bug 1318
Collapse All | Expand All

(-)a/src/internet/model/ipv6-l3-protocol.cc (-7 / +9 lines)
 Lines 993-1007    Link Here 
993
  uint8_t nextHeaderPosition = 0;
993
  uint8_t nextHeaderPosition = 0;
994
  bool isDropped = false;
994
  bool isDropped = false;
995
995
996
  /* process hop-by-hop extension first if exists */
996
  // check for a malformed hop-by-hop extension
997
  // this is a common case when forging IPv6 raw packets
997
  if (nextHeader == Ipv6Header::IPV6_EXT_HOP_BY_HOP)
998
  if (nextHeader == Ipv6Header::IPV6_EXT_HOP_BY_HOP)
998
    {
999
    {
999
      uint8_t buf[2];
1000
      uint8_t buf;
1000
      p->CopyData (buf, sizeof(buf));
1001
      p->CopyData (&buf, 1);
1001
      nextHeader = buf[0];
1002
      if (buf == Ipv6Header::IPV6_EXT_HOP_BY_HOP)
1002
      nextHeaderPosition = buf[1];
1003
        {
1003
      NS_ASSERT_MSG (nextHeader != Ipv6Header::IPV6_EXT_HOP_BY_HOP, "Double Ipv6Header::IPV6_EXT_HOP_BY_HOP in packet, aborting");
1004
          NS_LOG_WARN("Double Ipv6Header::IPV6_EXT_HOP_BY_HOP in packet, dropping packet");
1004
      NS_ASSERT_MSG (nextHeaderPosition != 0, "Zero-size IPv6 Option Header, aborting");
1005
          return;
1006
        }
1005
    }
1007
    }
1006
1008
1007
  /* process all the extensions found and the layer 4 protocol */
1009
  /* process all the extensions found and the layer 4 protocol */

Return to bug 1318