ICMPv6: Add a length check in the rpl_dio_print() function

(backported from commit 23b99286ca05088ab94074100c96771bed0865e0)

diff --git a/print-icmp6.c b/print-icmp6.c
index 63c202c4eaf70e2076c8a67cdf580ef60fe3bd89..0ba65690147a303025a084600462cbce79b79240 100644 (file)
--- a/print-icmp6.c
+++ b/print-icmp6.c
@@ -851,6 +851,7 @@ rpl_dio_print(netdissect_options *ndo,
 {
         const struct nd_rpl_dio *dio = (const struct nd_rpl_dio *)bp;
 
+        ND_LCHECK_ZU(length, sizeof(struct nd_rpl_dio));
         ND_PRINT(" [dagid:%s,seq:%u,instance:%u,rank:%u,%smop:%s,prf:%u]",
                   GET_IP6ADDR_STRING(dio->rpl_dagid),
                   GET_U_1(dio->rpl_dtsn),
@@ -865,6 +866,9 @@ rpl_dio_print(netdissect_options *ndo,
                 rpl_printopts(ndo, bp + sizeof(struct nd_rpl_dio),
                               length - sizeof(struct nd_rpl_dio));
         }
+        return;
+invalid:
+        nd_print_invalid(ndo);
 }
 
 static void