From dd9c0b3fd58a0c541a55feebd5ec6aa7cf6f207b Mon Sep 17 00:00:00 2001
From: Matias Fontanini <matias.fontanini@gmail.com>
Date: Sat, 1 Dec 2012 13:43:19 -0300
Subject: [PATCH] Fixed bugs in IPv6 and ICMPv6 when constructing an object
 from a buffer.

---
 src/icmpv6.cpp | 4 ++--
 src/ipv6.cpp   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/icmpv6.cpp b/src/icmpv6.cpp
index 7ab9cc7..c33c1b9 100644
--- a/src/icmpv6.cpp
+++ b/src/icmpv6.cpp
@@ -84,10 +84,10 @@ ICMPv6::ICMPv6(const uint8_t *buffer, uint32_t total_sz)
 
 void ICMPv6::parse_options(const uint8_t *&buffer, uint32_t &total_sz) {
     while(total_sz > 0) {
-        if(total_sz < 8 || (static_cast<uint32_t>(buffer[1]) * 8) > total_sz) 
+        if(total_sz < 8 || (static_cast<uint32_t>(buffer[1]) * 8) > total_sz || buffer[1] < 1) 
             throw std::runtime_error("Not enough size for options");
         // size(option) = option_size - identifier_size - length_identifier_size
-        add_option(icmpv6_option(buffer[0], buffer[1] * 8 - sizeof(uint8_t) * 2, buffer + 2));
+        add_option(icmpv6_option(buffer[0], static_cast<uint32_t>(buffer[1]) * 8 - sizeof(uint8_t) * 2, buffer + 2));
         total_sz -= buffer[1] * 8;
         buffer += buffer[1] * 8;
     }
diff --git a/src/ipv6.cpp b/src/ipv6.cpp
index e82c273..559fb94 100644
--- a/src/ipv6.cpp
+++ b/src/ipv6.cpp
@@ -40,7 +40,7 @@ IPv6::IPv6(const uint8_t *buffer, uint32_t total_sz)
                 throw header_size_error();
             // every ext header is at least 8 bytes long
             // minus one, from the next_header field.
-            uint8_t size = buffer[1] + 8;
+            uint32_t size = static_cast<uint32_t>(buffer[1]) + 8;
             // -1 -> next header identifier
             if(total_sz < size) 
                 throw header_size_error();