nd6: Fix RA link-local address option length check

Length field is in units of 8 bytes.
lwip-tcpip · Sep 28, 2023 · 6f700a1 · 6f700a1
1 parent 2159f84
commit 6f700a1
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/src/core/ipv6/nd6.c b/src/core/ipv6/nd6.c
@@ -687,12 +687,11 @@ nd6_input(struct pbuf *p, struct netif *inp)
       case ND6_OPTION_TYPE_SOURCE_LLADDR:
       {
         struct lladdr_option *lladdr_opt;
-        if (option_len < ND6_LLADDR_OPTION_MIN_LENGTH) {
+        if (option_len < (ND6_LLADDR_OPTION_MIN_LENGTH + inp->hwaddr_len)) {
           goto lenerr_drop_free_return;
         }
         lladdr_opt = (struct lladdr_option *)buffer;
-        if ((lladdr_opt->length == inp->hwaddr_len) &&
-            (default_router_list[i].neighbor_entry != NULL) &&
+        if ((default_router_list[i].neighbor_entry != NULL) &&
             (default_router_list[i].neighbor_entry->state == ND6_INCOMPLETE)) {
           SMEMCPY(default_router_list[i].neighbor_entry->lladdr, lladdr_opt->addr, inp->hwaddr_len);
           default_router_list[i].neighbor_entry->state = ND6_REACHABLE;