jerpelea opened a new pull request, #21311: URL: https://github.com/apache/nuttx/pull/21311
## Summary The MLDv2 report handler trusted the attacker-controlled multicast address record count and indexed records using a fixed stride. MLDv2 records are variable length because they include a source-address list and optional auxiliary data. A malformed report with a large record count or truncated variable-length record could make the parser read past the received ICMPv6 packet buffer. Derive the remaining MLD payload length from the IPv6 receive buffer, validate the fixed report header, walk each address record by its true encoded length, and reject truncated records or trailing length mismatches before reading the multicast address. ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
