From 869c93638d7171806c1a85a7d8f2f0510dc7a328 Mon Sep 17 00:00:00 2001 From: Zhe Weng Date: Thu, 24 Nov 2022 17:17:13 +0800 Subject: [PATCH] net/icmpv6: Fix `ipv6->len` in icmpv6_reply The `ipv6->len` is the length excluding the IPv6 header, so need to be `dev->d_len - IPv6_HDRLEN`. Signed-off-by: Zhe Weng --- net/icmpv6/icmpv6_reply.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/icmpv6/icmpv6_reply.c b/net/icmpv6/icmpv6_reply.c index b6be31624e..3d5ce1849a 100644 --- a/net/icmpv6/icmpv6_reply.c +++ b/net/icmpv6/icmpv6_reply.c @@ -88,6 +88,7 @@ void icmpv6_reply(FAR struct net_driver_s *dev, int type, int code, int data) FAR struct ipv6_hdr_s *ipv6 = IPv6BUF; FAR struct icmpv6_hdr_s *icmpv6 = (FAR struct icmpv6_hdr_s *)(ipv6 + 1); uint16_t datalen; + uint16_t paylen; if (net_ipv6addr_cmp(ipv6->destipaddr, g_ipv6_unspecaddr) # ifdef CONFIG_NET_BROADCAST @@ -111,6 +112,7 @@ void icmpv6_reply(FAR struct net_driver_s *dev, int type, int code, int data) } dev->d_len = ipicmplen + datalen; + paylen = dev->d_len - IPv6_HDRLEN; /* Copy fields from original packet */ @@ -121,8 +123,8 @@ void icmpv6_reply(FAR struct net_driver_s *dev, int type, int code, int data) ipv6->vtc = 0x60; /* Version/traffic class (MS) */ ipv6->tcf = 0; /* Traffic class(LS)/Flow label(MS) */ ipv6->flow = 0; /* Flow label (LS) */ - ipv6->len[0] = (dev->d_len >> 8); /* Length excludes the IPv6 header */ - ipv6->len[1] = (dev->d_len & 0xff); + ipv6->len[0] = (paylen >> 8); /* Length excludes the IPv6 header */ + ipv6->len[1] = (paylen & 0xff); ipv6->proto = IP_PROTO_ICMP6; /* Next header */ ipv6->ttl = 255; /* Hop limit */