[ipv6] Handle IPv6 option length correctly

The IPv6 option length field represents the length of the option data
field, not the overall length of the option.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/net/ipv6.c b/src/net/ipv6.c
index 08e8e10007bf38ab5b9788bfa32f200f6d6648b4..c5f8d2d910add3d5d59c9fbda9958379436eb6b7 100644 (file)
--- a/src/net/ipv6.c
+++ b/src/net/ipv6.c
@@ -250,7 +250,7 @@ static int ipv6_check_options ( struct ipv6_header *iphdr,
                if ( option->type == IPV6_OPT_PAD1 ) {
                        option = ( ( ( void * ) option ) + 1 );
                } else {
-                       option = ( ( ( void * ) option ) + option->len );
+                       option = ( ( ( void * ) option->value ) + option->len );
                }
        }
        return 0;