From: Michael Brown Date: Thu, 30 Jul 2026 11:44:40 +0000 (+0100) Subject: [ipv6] Use correct length when checking for truncated packets X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=678f84ff3ad1c9930b3be8ceee6601fb70d8fde4;p=thirdparty%2Fipxe.git [ipv6] Use correct length when checking for truncated packets The IPv6 header length field contains the payload length (excluding the length of the IPv6 header itself). The IPv6 packet parser calculates the length of the received packet correctly, but wrongly uses the payload length (rather than the full packet length) when checking for truncated packets. Fix by calculating the packet length exactly once and using it for both purposes. Signed-off-by: Michael Brown --- diff --git a/src/net/ipv6.c b/src/net/ipv6.c index 7e908dd2a..6d7695853 100644 --- a/src/net/ipv6.c +++ b/src/net/ipv6.c @@ -691,7 +691,7 @@ static int ipv6_rx ( struct io_buffer *iobuf, struct net_device *netdev, } /* Truncate packet to specified length */ - len = ntohs ( iphdr->len ); + len = ( sizeof ( *iphdr ) + ntohs ( iphdr->len ) ); if ( len > iob_len ( iobuf ) ) { DBGC ( ipv6col ( &iphdr->src ), "IPv6 length too long at %zd " "bytes (packet is %zd bytes)\n", len, iob_len ( iobuf )); @@ -699,7 +699,7 @@ static int ipv6_rx ( struct io_buffer *iobuf, struct net_device *netdev, rc = -EINVAL_LEN; goto err_other; } - iob_unput ( iobuf, ( iob_len ( iobuf ) - len - sizeof ( *iphdr ) ) ); + iob_unput ( iobuf, ( iob_len ( iobuf ) - len ) ); hdrlen = sizeof ( *iphdr ); /* Print IPv6 header for debugging */