From: Michael Brown <mcb30@ipxe.org>
Date: Wed, 23 Oct 2013 12:05:23 +0000 (+0100)
Subject: [ipv6] Handle IPv6 option length correctly
X-Git-Tag: v1.20.1~1395
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=595e32d7abca1292c2b2a0cfebf50e31eb287676;p=thirdparty%2Fipxe.git

[ipv6] Handle IPv6 option length correctly

The IPv6 option length field represents the length of the option data
field, not the overall length of the option.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/net/ipv6.c b/src/net/ipv6.c
index 08e8e1000..c5f8d2d91 100644
--- a/src/net/ipv6.c
+++ b/src/net/ipv6.c
@@ -250,7 +250,7 @@ static int ipv6_check_options ( struct ipv6_header *iphdr,
 		if ( option->type == IPV6_OPT_PAD1 ) {
 			option = ( ( ( void * ) option ) + 1 );
 		} else {
-			option = ( ( ( void * ) option ) + option->len );
+			option = ( ( ( void * ) option->value ) + option->len );
 		}
 	}
 	return 0;