Skip to content

Commit

Permalink
fix: 6lowpan panic when frag datagram_size < 40
Browse files Browse the repository at this point in the history
6LoWPAN fragmentation could panic when the datagram_size in the
fragmentation header is less than 40. When converting 6LoWPAN to IPv6 a
minimum size of 40 bytes is required to put the IPv6 header in the
buffer.
  • Loading branch information
thvdveld committed Sep 30, 2024
1 parent c114acd commit 6256c3e
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions src/iface/interface/sixlowpan.rs
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,15 @@ impl InterfaceInner {
// unless we have a complete one after processing this fragment.
let frag = check!(SixlowpanFragPacket::new_checked(payload));

// From RFC 4944 § 5.3: "The value of datagram_size SHALL be 40 octets more than the value
// of Payload Length in the IPv6 header of the packet."
// We should check that this is true, otherwise `buffer.split_at_mut(40)` will panic, since
// we assume that the decompressed packet is at least 40 bytes.
if frag.datagram_size() < 40 {
net_debug!("6LoWPAN: fragment size too small");
return None;
}

// The key specifies to which 6LoWPAN fragment it belongs too.
// It is based on the link layer addresses, the tag and the size.
let key = FragKey::Sixlowpan(frag.get_key(ieee802154_repr));
Expand Down

0 comments on commit 6256c3e

Please sign in to comment.