Skip to content

fix(ipv6-ext): IPv6_Ext rebuild drops the header body, and an overrun writes Hdr Ext Len 0xff #1230

Closed

Description

@JarryShaw

Describe the bug
IPv6_Ext._make_data (ipv6_ext.py:617-645) passes only cls._make_payload(data), the upper layer, so the opaque body after the first two octets is never emitted. The length octet comes from data.length, which is then wrong. With next=None (overrun) data.length // 8 - 1 is -1 and is written as ff.

To Reproduce
IPv6_Ext(io.BytesIO(b), len(b), extension=True, alias=140), then IPv6_Ext.from_data(p.info).data.hex(): 3b00010203040506 -> 3b00; 3b01 + 14 octets -> 3b01; a bare 3b00 (needs 8) -> 00ff. Through IPv6 with next=140 the 8-octet header rebuilds as 2.

Expected behavior
The body is recorded and re-emitted so the rebuild is byte-exact; an overrun is not written as -1.

Found by the internet-v6 round-trip audit (#1202); reproduced on main at 11ae68ebf (repro check D3).

Found by the internet-v6 round-trip audit (#1202). The repro was re-checked by an independent verifier, and I re-ran it on main at 11ae68ebf.

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 7, 2026
  2. JarryShaw commented on Oct 7, 2026

    @JarryShaw
    OwnerAuthor

    A worker is on it now.

  3. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 7, 2026
  4. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions