[lwip-devel] [bug #44586] nd6_send_rs() pbuf size error!

[hanhui]

URL:
  <http://savannah.nongnu.org/bugs/?44586>

                 Summary: nd6_send_rs() pbuf size error!
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: hanhui03
            Submitted on: Fri 20 Mar 2015 08:26:39 AM GMT
                Category: IPv6
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: git head

    _______________________________________________________

Details:

  nd6_send_rs() 

  p = pbuf_alloc(PBUF_IP, sizeof(struct rs_header) + lladdr_opt_len,
PBUF_RAM);
  if ((p == NULL) || (p->len < (sizeof(struct rs_header) + lladdr_opt_len)))
{

should be:

  p = pbuf_alloc(PBUF_IP, sizeof(struct rs_header) + (lladdr_opt_len << 3),
PBUF_RAM);
  if ((p == NULL) || (p->len < (sizeof(struct rs_header) + (lladdr_opt_len <<
3)))) {




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?44586>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/