From: Russ Combs <rucombs@cisco.com>
Date: Wed, 4 Feb 2015 21:59:59 +0000 (-0500)
Subject: fix encoder check for ip6 extensions
X-Git-Tag: 3.0.0-233~1058
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1aa575ac02260b979424e5fea2e37b9abe8d85f;p=thirdparty%2Fsnort3.git

fix encoder check for ip6 extensions
---

diff --git a/ChangeLog b/ChangeLog
index 657dd30fe..9ace11aea 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,6 @@
 Pending - build 136
 
+-- fix encoder check for ip6 extensions
 -- sync normalizatons with 297
 
 15/01/29 - build 135
diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc
index 1550cf440..977e66425 100644
--- a/src/protocols/layer.cc
+++ b/src/protocols/layer.cc
@@ -19,6 +19,7 @@
 
 
 #include <netinet/in.h>
+#include <limits>
 #include "protocols/layer.h"
 #include "protocols/protocol_ids.h"
 #include "protocols/packet.h"
@@ -271,7 +272,9 @@ bool set_inner_ip_api(const Packet* const p,
     if (curr_layer < 0 || curr_layer >= p->num_layers)
         return false;
 
-    if (is_ip6_extension(p->layers[curr_layer].prot_id))
+    const uint16_t proto = p->layers[curr_layer].prot_id;
+    const uint8_t ip_proto_max = std::numeric_limits<uint8_t>::max();
+    if ( (proto <= ip_proto_max) && is_ip6_extension((uin8_t)proto) )
     {
         const ip::IP6Extension* const ip6_ext =
             reinterpret_cast<const ip::IP6Extension*>(p->layers[curr_layer].start);