net: if: ipv6_prefix_find() correctly tests if the prefix is used
ipv6_prefix_find() wrongly tests if the unicast address is in use
instead of the prefix. This has two implications:
- The function can return an expired prefix to net_if_ipv6_prefix_add(),
which will do nothing more to enable it (since it assumes that it is
already enabled). As a result, the prefix will not be used by the
rest of the stack due to prefix->is_used being false.
- ipv6_prefix_find() loops using a bound of NET_IF_MAX_IPV6_PREFIX, but
the size of the unicast[] array is defined by NET_IF_MAX_IPV6_ADDR.
This could lead to an out-of-bound access if NET_IF_MAX_IPV6_ADDR is
smaller than NET_IF_MAX_IPV6_PREFIX.
Signed-off-by:
Florian Vaussard <florian.vaussard@gmail.com>
Loading
Please sign in to comment