From eecb030ae9ab646d0f0cc8c3777fb81b542b845b Mon Sep 17 00:00:00 2001 From: Tommaso Pecorella Date: Mon, 9 Jan 2012 18:48:14 +0100 Subject: [PATCH] Bug 1318 - Asserts for IPv6 malformed packets --- src/internet/model/ipv6-l3-protocol.cc | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/internet/model/ipv6-l3-protocol.cc b/src/internet/model/ipv6-l3-protocol.cc index 42e2bce4d..96ea39f7b 100644 --- a/src/internet/model/ipv6-l3-protocol.cc +++ b/src/internet/model/ipv6-l3-protocol.cc @@ -957,6 +957,8 @@ void Ipv6L3Protocol::LocalDeliver (Ptr packet, Ipv6Header const& i p->CopyData (buf, sizeof(buf)); nextHeader = buf[0]; nextHeaderPosition = buf[1]; + NS_ASSERT_MSG (nextHeader != Ipv6Header::IPV6_EXT_HOP_BY_HOP, "Double Ipv6Header::IPV6_EXT_HOP_BY_HOP in packet, aborting"); + NS_ASSERT_MSG (nextHeaderPosition != 0, "Zero-size IPv6 Option Header, aborting"); } /* process all the extensions found and the layer 4 protocol */ @@ -966,7 +968,11 @@ void Ipv6L3Protocol::LocalDeliver (Ptr packet, Ipv6Header const& i if (ipv6Extension) { - nextHeaderPosition += ipv6Extension->Process (p, nextHeaderPosition, ip, dst, &nextHeader, isDropped); + uint8_t nextHeaderStep = 0; + nextHeaderStep = ipv6Extension->Process (p, nextHeaderPosition, ip, dst, &nextHeader, isDropped); + nextHeaderPosition += nextHeaderStep; + + NS_ASSERT_MSG (nextHeaderStep != 0, "Zero-size IPv6 Option Header, aborting"); if (isDropped) {