Type:
Buffer overflow

Description:
This bug is similar to bug #58553. The function zepif_linkoutput() tries to parse an 6LoWPAN TX packet as UDP broadcast. When it calls the function pbuf_take_at() as shown in line 204 of zepif.c, the same incorrectly used parameters are passed as the Bug 2. In particular, the p->tot_len is the total length of the p->payload and all payloads length of its following pbuf. If p->tot_len is larger than the length of p->payload, the memory will leak to remote attackers through the network. To send the whole packet, it should use a loop to traverse the list of p->next and send all the payloads with length p->tot_len.

168
zepif_linkoutput(struct netif *netif, struct pbuf *p){

...
204
err = pbuf_take_at(q, p->payload, p->tot_len, sizeof(struct zep_hdr));

...
214
}

Result:
Memory disclosure.