It seems to me that the current master version of nd6_input function has some 
byte ordering problems.

For example, in nd6_input()

Line 439:
      case ND6_OPTION_TYPE_MTU:
     {
        struct mtu_option * mtu_opt;
        mtu_opt = (struct mtu_option *)buffer;
        if (mtu_opt->mtu >= 1280) {
#if LWIP_ND6_ALLOW_RA_UPDATES
          inp->mtu = mtu_opt->mtu;
#endif /* LWIP_ND6_ALLOW_RA_UPDATES */
        }
        break;
      }

As mtu_opt->mtu is a u32_t, it seems to me like it should be this:

      case ND6_OPTION_TYPE_MTU:
      {
        struct mtu_option * mtu_opt;
        mtu_opt = (struct mtu_option *)buffer;
        if (ntohl(mtu_opt->mtu) >= 1280) {                  /* zs: added 
ntohl() */
#if LWIP_ND6_ALLOW_RA_UPDATES
          inp->mtu = ntohl(mtu_opt->mtu);                   /* zs: added 
ntohl() */
#endif /* LWIP_ND6_ALLOW_RA_UPDATES */
        }
        break;
      }

Am I correct that this is a bug?
There are a few other accesses in nd6_input() like this that I think should be 
done using ntohl() or ntohs().

-Zach
_______________________________________________
lwip-users mailing list
[email protected]
https://lists.nongnu.org/mailman/listinfo/lwip-users

Reply via email to