icmp6 fix no respond to neighbor solicit message

The structure size used in grub_netbuff_pull to get the pointer to
option header is apparently wrong, which leads to subsequent range check
failed and therefore not responding to any neighbor solicit message in my
testing.

diff --git a/ChangeLog b/ChangeLog
index 190d19d9b25e9c20c183b433ed2205b062ca35b7..87faadf480d620d52cbd461b5c426cd92ef2ad22 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2014-11-03  Michael Chang  <mchang@suse.com>
+
+       * grub-core/net/icmp6.c (grub_net_recv_icmp6_packet): Fix size
+       of neighbor solicitation packet in grub_netbuff_pull.
+
 2014-10-14  Andrei Borzenkov  <arvidjaar@gmail.com>
 
        * grub-core/loader/arm/linux.c: Use full initializer for initrd_ctx to

diff --git a/grub-core/net/icmp6.c b/grub-core/net/icmp6.c
index bbc902014fea9fe64f971f78bc09a7384d03ccbc..796d549f640b20b52908b343974440e702108b69 100644 (file)
--- a/grub-core/net/icmp6.c
+++ b/grub-core/net/icmp6.c
@@ -205,7 +205,7 @@ grub_net_recv_icmp6_packet (struct grub_net_buff *nb,
        if (ttl != 0xff)
          break;
        nbh = (struct neighbour_solicit *) nb->data;
-       err = grub_netbuff_pull (nb, sizeof (struct router_adv));
+       err = grub_netbuff_pull (nb, sizeof (*nbh));
        if (err)
          {
            grub_netbuff_free (nb);