GHSA-pf5q-r6q5-6j2f: Potential out of bound read in _nx_ip_packet_receive()

The_nx_ip_packet_receive() function looks at the first byte in the IP header to determine the IP version, and calls v4 or v6 accordingly. There is no bounds check prior to reading the IP version. If a malicious attacker sends an ethernet frame with 0 bytes of IP data, then it could read out of bound (or interpret non IP data as IP data). In theory, an out of bound read could lead to a crash or possibly to an information leak.

code:

threadx\netxduo-master\common\src\nx_ip_packet_receive.c

It might be that a specific NIC driver performs a check to make sure the first IP byte is guaranteed, however, even if so, that would be a check done at the wrong layer. It should be performed at the IP layer. It would then also depend on all NIC drivers doing this consistently.