This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch releases/13.1 in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit c04b45281a320816bdd158c87057e9e15bcdfd04 Author: chao an <[email protected]> AuthorDate: Thu Oct 29 14:27:46 2026 +0800 net/icmpv6: Bound RA options by ICMPv6 length Router Advertisement options belong to the ICMPv6 message, not to the whole IPv6 payload. When extension headers are present, using the IPv6 payload length makes the option walker include extension-header bytes in its available option length. Use ICMPv6SIZE so the option parser is bounded by the actual ICMPv6 message length after the IPv6 header and any extension headers. Signed-off-by: chao an <[email protected]> --- net/icmpv6/icmpv6_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/icmpv6/icmpv6_input.c b/net/icmpv6/icmpv6_input.c index 799bafc6140..a80c476b418 100644 --- a/net/icmpv6/icmpv6_input.c +++ b/net/icmpv6/icmpv6_input.c @@ -405,7 +405,7 @@ void icmpv6_input(FAR struct net_driver_s *dev, unsigned int iplen) /* Get the length of the option data */ - pktlen = (uint16_t)ipv6->len[0] << 8 | ipv6->len[1]; + pktlen = ICMPv6SIZE; if (pktlen <= ICMPv6_RADV_MINLEN) { /* Too small to contain any options */
