96c3fd12c4
ipv6_prefix_find() wrongly tests if the unicast address is in use instead of the prefix. This has two implications: - The function can return an expired prefix to net_if_ipv6_prefix_add(), which will do nothing more to enable it (since it assumes that it is already enabled). As a result, the prefix will not be used by the rest of the stack due to prefix->is_used being false. - ipv6_prefix_find() loops using a bound of NET_IF_MAX_IPV6_PREFIX, but the size of the unicast[] array is defined by NET_IF_MAX_IPV6_ADDR. This could lead to an out-of-bound access if NET_IF_MAX_IPV6_ADDR is smaller than NET_IF_MAX_IPV6_PREFIX. Signed-off-by: Florian Vaussard <florian.vaussard@gmail.com> |
||
|---|---|---|
| .. | ||
| 6lo_private.h | ||
| 6lo.c | ||
| 6lo.h | ||
| canbus_socket.c | ||
| canbus_socket.h | ||
| CMakeLists.txt | ||
| connection.c | ||
| connection.h | ||
| dhcpv4.c | ||
| dhcpv4.h | ||
| icmpv4.c | ||
| icmpv4.h | ||
| icmpv6.c | ||
| icmpv6.h | ||
| igmp.c | ||
| ipv4_autoconf_internal.h | ||
| ipv4_autoconf.c | ||
| ipv4.c | ||
| ipv4.h | ||
| ipv6_fragment.c | ||
| ipv6_mld.c | ||
| ipv6_nbr.c | ||
| ipv6.c | ||
| ipv6.h | ||
| Kconfig | ||
| Kconfig.debug | ||
| Kconfig.ipv4 | ||
| Kconfig.ipv6 | ||
| Kconfig.mgmt | ||
| Kconfig.stack | ||
| Kconfig.stats | ||
| nbr.c | ||
| nbr.h | ||
| net_context.c | ||
| net_core.c | ||
| net_if.c | ||
| net_mgmt.c | ||
| net_pkt.c | ||
| net_private.h | ||
| net_shell.c | ||
| net_shell.h | ||
| net_stats.c | ||
| net_stats.h | ||
| net_tc_mapping.h | ||
| net_tc.c | ||
| net_timeout.c | ||
| packet_socket.c | ||
| packet_socket.h | ||
| promiscuous.c | ||
| route.c | ||
| route.h | ||
| tcp2_priv.h | ||
| tcp2.c | ||
| tcp2.h | ||
| tcp_internal.h | ||
| tp_priv.h | ||
| tp.c | ||
| tp.h | ||
| trickle.c | ||
| udp_internal.h | ||
| udp.c | ||
| utils.c | ||