anchao opened a new pull request, #20886: URL: https://github.com/apache/nuttx/pull/20886
## Summary
Harden MLDv2 Multicast Listener Report parsing against malformed
variable-length address records.
The previous MLDv2 report handler trusted the packet-provided multicast
address record count and indexed records with a fixed stride. MLDv2 records are
variable length because they include a source-address list and optional
auxiliary data, so a malformed report could make the parser read past the
received ICMPv6 packet buffer.
## Changes
- Derive the remaining MLD payload length from the IPv6 receive buffer.
- Validate that the fixed MLDv2 report header is present before reading
`naddrec`.
- Walk multicast address records by their encoded variable length.
- Validate each record before reading its multicast address.
- Reject truncated records and trailing length mismatches.
## Testing
sim/matter
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
