packet: fix crasher found by go-fuzz due to misleading IP address lengths

mdlayher · mdlayher · commit f237799bcd57 · 2015-07-30T13:28:56.000-04:00
diff --git a/packet.go b/packet.go
@@ -125,10 +125,14 @@ func (p *Packet) MarshalBinary() ([]byte, error) {
 	// 1 byte : protocol length
 	// 2 bytes: operation
 	// N bytes: source hardware address
-	// 4 bytes: source protocol address
+	// N bytes: source protocol address
 	// N bytes: target hardware address
-	// 4 bytes: target protocol address
-	b := make([]byte, 2+2+1+1+2+4+4+(p.HardwareAddrLength*2))
+	// N bytes: target protocol address
+
+	// Though an IPv4 address should always 4 bytes, go-fuzz
+	// very quickly created several crasher scenarios which
+	// indicated that these values can lie.
+	b := make([]byte, 2+2+1+1+2+(p.IPLength*2)+(p.HardwareAddrLength*2))
 
 	// Marshal fixed length data
 
