devip: fix router adv/sol options validation (options padded to 8 bytes)

diff --git a/sys/src/9/ip/icmp6.c b/sys/src/9/ip/icmp6.c
index bceb6aeff1ee2aed07609dd48e03e3f34bed2865..b814070deeed8f067a143d49eaf879abf82cdf08 100644 (file)
--- a/sys/src/9/ip/icmp6.c
+++ b/sys/src/9/ip/icmp6.c
@@ -617,7 +617,7 @@ valid(Proto *icmp, Ipifc *ifc, Block *bp, Icmppriv6 *ipriv)
                                goto err;
                        }
                        sz = IPICMPSZ + 8;
-                       while (sz+1 < pktsz) {
+                       while (sz+8 <= pktsz) {
                                osz = packet[sz+1];
                                if(osz <= 0) {
                                        ipriv->stats[OptlenErrs6]++;
@@ -634,7 +634,7 @@ valid(Proto *icmp, Ipifc *ifc, Block *bp, Icmppriv6 *ipriv)
                        }
                        unsp = (ipcmp(p->src, v6Unspecified) == 0);
                        sz = IPICMPSZ + 8;
-                       while (sz+1 < pktsz) {
+                       while (sz+8 <= pktsz) {
                                osz = packet[sz+1];
                                if(osz <= 0 ||
                                    (unsp && packet[sz] == SRC_LLADDR)) {