The length field of the option header does not count the size of the option header itself. This causes a problem when the length is zero, the count is then incremented by zero, which causes an infinite loop.
In addition there are pointer/offset mistakes in the handling of IPv4 options.
