net: ip: Fix for improper offset return by `net_pkt_find_offset()`
The original packet's link-layer destination and source address can be
stored in separately allocated memory. This allocated memory can be
placed just after pkt data buffers.
In case when `net_pkt_find_offset()` uses condition:
`if (buf->data <= ptr && ptr <= (buf->data + buf->len)) {`
the offset is set outside the packet's buffer and the function returns
incorrect offset instead of error code.
Finally the offset is used to set ll address in cloned packet, and
this can have unexpected behavior (e.g. crash when cursor will be set
to empty memory).
Signed-off-by: Marcin Gasiorek <marcin.gasiorek@nordicsemi.no>
(cherry picked from commit fb99f65fe9a9e7c05f352903a3a41622d61fda8d)
1 file changed
