1 files changed, 10 insertions, 0 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 67636a1fc..4cbe722c2 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -3446,21 +3446,25 @@ int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struct *ndpi
     if(*nxt_hdr == 59) {
       return(1);
     }
+    
     // fragment extension header has fixed size of 8 bytes and the first byte is the next header type
     if(*nxt_hdr == 44) {
       if(*l4len < 8) {
 	return(1);
       }
+      
       *nxt_hdr = (*l4ptr)[0];
       *l4len -= 8;
       (*l4ptr) += 8;
       continue;
     }
+    
     // the other extension headers have one byte for the next header type
     // and one byte for the extension header length in 8 byte steps minus the first 8 bytes
     if(*l4len < 2) {
       return(1);
     }
+    
     ehdr_len = (*l4ptr)[1];
     ehdr_len *= 8;
     ehdr_len += 8;
@@ -3468,10 +3472,16 @@ int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struct *ndpi
     if(*l4len < ehdr_len) {
       return(1);
     }
+    
     *nxt_hdr = (*l4ptr)[0];
+
+    if(*l4len < ehdr_len)
+      return(1);
+    
     *l4len -= ehdr_len;
     (*l4ptr) += ehdr_len;
   }
+  
   return(0);
 }
 #endif /* NDPI_DETECTION_SUPPORT_IPV6 */