Fix buffer over read in ndpi_handle_ipv6_extension_headers

1 files changed, 3 insertions, 0 deletions

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index ac8364761..cf463793d 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -3518,6 +3518,9 @@ static int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struc
     }
     // the other extension headers have one byte for the next header type
     // and one byte for the extension header length in 8 byte steps minus the first 8 bytes
+    if (*l4len < 2) {
+      return(1);
+    }
     ehdr_len = (*l4ptr)[1];
     ehdr_len *= 8;
     ehdr_len += 8;