ESP32: Drop Invalid RA packets (#33060) (#33104)

project-chip · Apr 23, 2024 · 4431f18 · 4431f18
1 parent 64c07c6
commit 4431f18
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/platform/ESP32/route_hook/ESP32RouteHook.c b/src/platform/ESP32/route_hook/ESP32RouteHook.c
@@ -65,6 +65,11 @@ static void ra_recv_handler(struct netif * netif, const uint8_t * icmp_payload,
     {
         uint8_t opt_type = icmp_payload[0];
         uint8_t opt_len  = (uint8_t) (icmp_payload[1] << 3);
+        if (opt_len == 0 || opt_len > payload_len)
+        {
+            ESP_LOGE(TAG, "Invalid ND6 option length");
+            break;
+        }
 
         if (opt_type == ND6_OPTION_TYPE_ROUTE_INFO && opt_len >= sizeof(route_option_t) - sizeof(ip6_addr_p_t) &&
             !is_self_address(netif, src_addr) && payload_len >= opt_len)