mirror of
https://github.com/oliverschmidt/contiki.git
synced 2024-09-11 21:55:41 +00:00
RPL: prevent unintended memory access (rpl_remove_header)
When it goes to the default label in the switch statement of rpl_remove_header(), UIP_EXT_BUF does not always point to an IPv6 extension header. "Move to next header" process should be done only in case of UIP_PROTO_DESTO. Otherwise, it returns with doing nothing.
This commit is contained in:
parent
e361c49f14
commit
5a79bad4b1
@ -655,11 +655,6 @@ rpl_remove_header(void)
|
|||||||
/* Look for hop-by-hop and routing headers */
|
/* Look for hop-by-hop and routing headers */
|
||||||
while(uip_next_hdr != NULL) {
|
while(uip_next_hdr != NULL) {
|
||||||
switch(*uip_next_hdr) {
|
switch(*uip_next_hdr) {
|
||||||
case UIP_PROTO_TCP:
|
|
||||||
case UIP_PROTO_UDP:
|
|
||||||
case UIP_PROTO_ICMP6:
|
|
||||||
case UIP_PROTO_NONE:
|
|
||||||
return;
|
|
||||||
case UIP_PROTO_HBHO:
|
case UIP_PROTO_HBHO:
|
||||||
case UIP_PROTO_ROUTING:
|
case UIP_PROTO_ROUTING:
|
||||||
/* Remove hop-by-hop and routing headers */
|
/* Remove hop-by-hop and routing headers */
|
||||||
@ -674,13 +669,22 @@ rpl_remove_header(void)
|
|||||||
PRINTF("RPL: Removing RPL extension header (type %u, len %u)\n", *uip_next_hdr, rpl_ext_hdr_len);
|
PRINTF("RPL: Removing RPL extension header (type %u, len %u)\n", *uip_next_hdr, rpl_ext_hdr_len);
|
||||||
memmove(UIP_EXT_BUF, ((uint8_t *)UIP_EXT_BUF) + rpl_ext_hdr_len, uip_len - UIP_IPH_LEN);
|
memmove(UIP_EXT_BUF, ((uint8_t *)UIP_EXT_BUF) + rpl_ext_hdr_len, uip_len - UIP_IPH_LEN);
|
||||||
break;
|
break;
|
||||||
default:
|
case UIP_PROTO_DESTO:
|
||||||
|
/*
|
||||||
|
* As per RFC 2460, any header other than the Destination
|
||||||
|
* Options header does not appear between the Hop-by-Hop
|
||||||
|
* Options header and the Routing header.
|
||||||
|
*
|
||||||
|
* We're moving to the next header only if uip_next_hdr has
|
||||||
|
* UIP_PROTO_DESTO. Otherwise, we'll return.
|
||||||
|
*/
|
||||||
/* Move to next header */
|
/* Move to next header */
|
||||||
if(uip_next_hdr != &UIP_IP_BUF->proto) {
|
if(uip_next_hdr != &UIP_IP_BUF->proto) {
|
||||||
uip_ext_len += (UIP_EXT_BUF->len << 3) + 8;
|
uip_ext_len += (UIP_EXT_BUF->len << 3) + 8;
|
||||||
}
|
}
|
||||||
uip_next_hdr = &UIP_EXT_BUF->next;
|
uip_next_hdr = &UIP_EXT_BUF->next;
|
||||||
break;
|
default:
|
||||||
|
return;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user