]> The Tcpdump Group git mirrors - tcpdump/commit
CVE-2017-12986/IPv6 R.H.: Update to reflect the actual IPv6 RFC.
authorGuy Harris <[email protected]>
Sat, 4 Feb 2017 22:06:23 +0000 (14:06 -0800)
committerDenis Ovsienko <[email protected]>
Wed, 13 Sep 2017 11:25:44 +0000 (12:25 +0100)
commit7ac73d6cd41e9d4ac0ca7e6830ca390e195bb21c
tree36ec33f377c8df647515a4c1016c42f0a9c81488
parent3c4d7c0ee30a30e5abff3d6d9586a3753101faf5
CVE-2017-12986/IPv6 R.H.: Update to reflect the actual IPv6 RFC.

In RFC 1883, the Type 0 routing header had a 1-byte reserved field and a
3-byte strict/loose bit map; in RFC 2460, that changed to a 4-byte
reserved field.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter (by
making an ND_TCHECK() call check for the presence in the captured data
of all 4 bytes of the reserved field; we were printing it as a 4-byte
field, so we needed to check for them).

Add a test using the capture file supplied by the reporter(s).
ip6.h
tests/TESTLIST
tests/ipv6-rthdr-oobr.out [new file with mode: 0644]
tests/ipv6-rthdr-oobr.pcap [new file with mode: 0644]