From abfeb502a8fcb45e83ab8d09d4a917974a665c4b Mon Sep 17 00:00:00 2001
From: Nate Brown <nbrown.us@gmail.com>
Date: Tue, 7 Jul 2026 13:28:52 -0500
Subject: [PATCH] iputil: fix infinite loop in ipv6FindUpperProtocol from uint8
 extension-header length overflow (#1784)

---
 iputil/packet.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/iputil/packet.go b/iputil/packet.go
index 99893822..c0c1921e 100644
--- a/iputil/packet.go
+++ b/iputil/packet.go
@@ -344,7 +344,7 @@ func ipv6FindUpperProtocol(packet []byte) (nextHeader uint8, offset int, isFragm
 				return nextHeader, offset, isFragment
 			}
 			nextHeader = packet[offset]
-			offset += int(packet[offset+1]+1) << 3
+			offset += (int(packet[offset+1]) + 1) << 3
 
 		case 44: // Fragment
 			if len(packet) < offset+8 {
@@ -361,7 +361,7 @@ func ipv6FindUpperProtocol(packet []byte) (nextHeader uint8, offset int, isFragm
 				return nextHeader, offset, isFragment
 			}
 			nextHeader = packet[offset]
-			offset += int(packet[offset+1]+2) << 2
+			offset += (int(packet[offset+1]) + 2) << 2
 
 		default:
 			return nextHeader, offset, isFragment