tree 00237536fbd9d8041151fad8a141411d493a3e80
parent 0de70854753d115d29abedfe38734778e5dece83
author Marcin Gasiorek <marcin.gasiorek@nordicsemi.no> 1709642679 +0100
committer github-actions[bot] <github-actions[bot]@users.noreply.github.com> 1709719341 +0000

net: ip: Fix for improper offset return by `net_pkt_find_offset()`

The original packet's link-layer destination and source address can be
stored in separately allocated memory. This allocated memory can be
placed just after pkt data buffers.
In case when `net_pkt_find_offset()` uses condition:
`if (buf->data <= ptr && ptr <= (buf->data + buf->len)) {`
the offset is set outside the packet's buffer and the function returns
incorrect offset instead of error code.
Finally the offset is used to set ll address in cloned packet, and
this can have unexpected behavior (e.g. crash when cursor will be set
to empty memory).

Signed-off-by: Marcin Gasiorek <marcin.gasiorek@nordicsemi.no>
(cherry picked from commit fb99f65fe9a9e7c05f352903a3a41622d61fda8d)