From bb6754e76bb1686315008e1aa1c40202a513fb83 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 25 Jun 2026 21:58:49 +0000
Subject: [PATCH] Fix extension header parsing. Credit: Himanshu Anand

---
 libnetutil/netutil.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc
index 5a2daf187..ba7cfe71a 100644
--- a/libnetutil/netutil.cc
+++ b/libnetutil/netutil.cc
@@ -700,11 +700,13 @@ static const u8 *ipv6_get_data_primitive(const struct ip6_hdr *ip6, const u8 *pa
   *nxt = ip6->ip6_nxt;
   p += sizeof(*ip6);
   while (p < end && ipv6_is_extension_header(*nxt)) {
-    if (p + 2 > end)
+    if (p + 8 > end)
       return NULL;
     *nxt = *p;
     p += (*(p + 1) + 1) * 8;
   }
+  if (p >= end)
+    return NULL;
 
   *len = end - p;
   if (upperlayer_only && !ipv6_is_upperlayer(*nxt))