jerpelea opened a new pull request, #21310: URL: https://github.com/apache/nuttx/pull/21310
## Summary The Router Advertisement parser validated the total option area length, but individual option handlers trusted each option's claimed length before reading fixed fields. A malformed on-link RA could place a truncated option at the end of the option area and make the PREFIX, MTU, source link-layer address, or RDNSS handler read past the received packet buffer. Validate that each option header is present, reject zero-length options, and ensure the claimed option length stays within the remaining option area before dispatching. Also validate the fixed fields required by each handler before reading them. ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
