3rd-party/libtins
1
0
Fork 0
mirror of https://github.com/mfontanini/libtins synced 2026-01-26 03:51:35 +01:00
Code Issues Releases Wiki Activity

Fixed bugs in IPv6 and ICMPv6 when constructing an object from a buffer.

Browse Source
This commit is contained in:
Matias Fontanini
2012-12-01 13:43:19 -03:00
parent 9bdee61e5b
commit dd9c0b3fd5
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/icmpv6.cpp
View File

@@ -84,10 +84,10 @@ ICMPv6::ICMPv6(const uint8_t *buffer, uint32_t total_sz)
void ICMPv6::parse_options(const uint8_t *&buffer, uint32_t &total_sz) {
while(total_sz > 0) {
if(total_sz < 8 || (static_cast<uint32_t>(buffer[1]) * 8) > total_sz)
if(total_sz < 8 || (static_cast<uint32_t>(buffer[1]) * 8) > total_sz || buffer[1] < 1)
throw std::runtime_error("Not enough size for options");
// size(option) = option_size - identifier_size - length_identifier_size
add_option(icmpv6_option(buffer[0], buffer[1] * 8 - sizeof(uint8_t) * 2, buffer + 2));
add_option(icmpv6_option(buffer[0], static_cast<uint32_t>(buffer[1]) * 8 - sizeof(uint8_t) * 2, buffer + 2));
total_sz -= buffer[1] * 8;
buffer += buffer[1] * 8;
}

2
src/ipv6.cpp
View File

@@ -40,7 +40,7 @@ IPv6::IPv6(const uint8_t *buffer, uint32_t total_sz)
throw header_size_error();
// every ext header is at least 8 bytes long
// minus one, from the next_header field.
uint8_t size = buffer[1] + 8;
uint32_t size = static_cast<uint32_t>(buffer[1]) + 8;
// -1 -> next header identifier
if(total_sz < size)
throw header_size_error();