diff --git a/net/icmpv6/icmpv6_input.c b/net/icmpv6/icmpv6_input.c index c3521917d65..28792be0ca1 100644 --- a/net/icmpv6/icmpv6_input.c +++ b/net/icmpv6/icmpv6_input.c @@ -428,6 +428,15 @@ void icmpv6_input(FAR struct net_driver_s *dev, unsigned int iplen) FAR struct icmpv6_generic_s *opt = (FAR struct icmpv6_generic_s *)&options[ndx]; + /* RFC 4861 4.6: "The value 0 is invalid. Nodes MUST silently + * discard a packet that contains an option with length zero." + */ + + if (opt->optlen == 0) + { + goto icmpv6_drop_packet; + } + switch (opt->opttype) { case ICMPv6_OPT_SRCLLADDR: