From 81e74d8e22365166043de40666f324df0533ccef Mon Sep 17 00:00:00 2001 From: Benoît Ganne Date: Thu, 24 Feb 2022 16:17:52 +0100 Subject: ip: fix overflow in ip6_ext_header_walk MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ip6_ext_hdr_chain_t->eh is IP6_EXT_HDR_MAX elements. Type: fix Change-Id: I28b8d610d8f5c0c520c8391c37b86e837655ab12 Signed-off-by: Benoît Ganne --- src/vnet/ip/ip6_packet.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/vnet/ip') diff --git a/src/vnet/ip/ip6_packet.h b/src/vnet/ip/ip6_packet.h index b00eac72c04..e71604ce7d3 100644 --- a/src/vnet/ip/ip6_packet.h +++ b/src/vnet/ip/ip6_packet.h @@ -652,7 +652,7 @@ ip6_ext_header_walk (vlib_buffer_t *b, ip6_header_t *ip, int find_hdr_type, i++; if (last) break; - if (i > IP6_EXT_HDR_MAX) + if (i >= IP6_EXT_HDR_MAX) break; next_header = ip6_ext_next_header_s (next_proto, next_header, max_offset, &offset, &next_proto, &last); -- cgit 1.2.3-korg