jerpelea opened a new pull request, #21312: URL: https://github.com/apache/nuttx/pull/21312
## Summary The IPv6 input path validated the packet payload length against the received buffer before walking extension headers, but the extension-header loop did not validate each header against the remaining packet length. A remote peer could advertise an oversized extension header length and cause the next loop iteration to read the next-header and length fields past the received packet buffer. Validate that the fixed extension-header prefix is present before dereferencing it, and validate that the computed extension-header length fits within the received packet before advancing to the next header. ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
