| diff --git a/src/core/ipv6/nd6.c b/src/core/ipv6/nd6.c |
| index 55b5774f..8559d69b 100644 |
| --- a/src/core/ipv6/nd6.c |
| +++ b/src/core/ipv6/nd6.c |
| @@ -686,14 +686,15 @@ nd6_input(struct pbuf *p, struct netif *inp) |
| switch (option_type) { |
| case ND6_OPTION_TYPE_SOURCE_LLADDR: |
| { |
| - struct lladdr_option *lladdr_opt; |
| - if (option_len < (ND6_LLADDR_OPTION_MIN_LENGTH + inp->hwaddr_len)) { |
| + const u8_t option_type_and_length_size = 1 + 1; |
| + const u8_t *addr_cursor; |
| + if (option_len < (option_type_and_length_size + inp->hwaddr_len)) { |
| goto lenerr_drop_free_return; |
| } |
| - lladdr_opt = (struct lladdr_option *)buffer; |
| + addr_cursor = buffer + option_type_and_length_size; |
| if ((default_router_list[i].neighbor_entry != NULL) && |
| (default_router_list[i].neighbor_entry->state == ND6_INCOMPLETE)) { |
| - SMEMCPY(default_router_list[i].neighbor_entry->lladdr, lladdr_opt->addr, inp->hwaddr_len); |
| + SMEMCPY(default_router_list[i].neighbor_entry->lladdr, addr_cursor, inp->hwaddr_len); |
| default_router_list[i].neighbor_entry->state = ND6_REACHABLE; |
| default_router_list[i].neighbor_entry->counter.reachable_time = reachable_time; |
| } |