The structure size used in grub_netbuff_pull to get the pointer to
option header is apparently wrong, which leads to subsequent range check
failed and therefore not responding to any neighbor solicit message in my
testing.
---
grub-core/net/icmp6.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/grub-core/net/icmp6.c b/grub-core/net/icmp6.c
index bbc9020..796d549 100644
--- a/grub-core/net/icmp6.c
+++ b/grub-core/net/icmp6.c
@@ -205,7 +205,7 @@ grub_net_recv_icmp6_packet (struct grub_net_buff *nb,
if (ttl != 0xff)
break;
nbh = (struct neighbour_solicit *) nb->data;
- err = grub_netbuff_pull (nb, sizeof (struct router_adv));
+ err = grub_netbuff_pull (nb, sizeof (*nbh));
if (err)
{
grub_netbuff_free (nb);
--
1.7.3.4
_______________________________________________
Grub-devel mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/grub-devel
