Skip to content

Commit 6256c3e

Browse files
committed
fix: 6lowpan panic when frag datagram_size < 40
6LoWPAN fragmentation could panic when the datagram_size in the fragmentation header is less than 40. When converting 6LoWPAN to IPv6 a minimum size of 40 bytes is required to put the IPv6 header in the buffer.
1 parent c114acd commit 6256c3e

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

src/iface/interface/sixlowpan.rs

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,15 @@ impl InterfaceInner {
114114
// unless we have a complete one after processing this fragment.
115115
let frag = check!(SixlowpanFragPacket::new_checked(payload));
116116

117+
// From RFC 4944 § 5.3: "The value of datagram_size SHALL be 40 octets more than the value
118+
// of Payload Length in the IPv6 header of the packet."
119+
// We should check that this is true, otherwise `buffer.split_at_mut(40)` will panic, since
120+
// we assume that the decompressed packet is at least 40 bytes.
121+
if frag.datagram_size() < 40 {
122+
net_debug!("6LoWPAN: fragment size too small");
123+
return None;
124+
}
125+
117126
// The key specifies to which 6LoWPAN fragment it belongs too.
118127
// It is based on the link layer addresses, the tag and the size.
119128
let key = FragKey::Sixlowpan(frag.get_key(ieee802154_repr));

0 commit comments

Comments
 (0)