Skip to content

Commit 36e815e

Browse files
committed
ipv6: prevent oob read in ipv6_neigh_storage_load_neigh()
calloc() does not reserve space for the trailing buffer in struct ipv6_neighbour. But also reading from the struct is not necessary since the EUI-64 is available in the local scope. WI_SUN-3137
1 parent 699ea45 commit 36e815e

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

6lbr/ipv6/ipv6_neigh_storage.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,8 +145,7 @@ static void ipv6_neigh_storage_load_neigh(struct ipv6_neighbour_cache *cache, co
145145
ipv6_neighbors[i].type != IP_NEIGHBOUR_REGISTERED)
146146
continue;
147147
if (IN6_IS_ADDR_MULTICAST(ipv6_neighbors[i].ip_address) &&
148-
ipv6_neighbour_lookup_mc(cache, ipv6_neighbors[i].ip_address,
149-
ipv6_neighbour_eui64(cache, &ipv6_neighbors[i])))
148+
ipv6_neighbour_lookup_mc(cache, ipv6_neighbors[i].ip_address, eui64))
150149
continue;
151150
else if (ipv6_neighbour_lookup(cache, ipv6_neighbors[i].ip_address))
152151
continue;

0 commit comments

Comments
 (0)