lldp: fix boundary checks when decoding LLDP protocol identity

diff --git a/src/daemon/lldp.c b/src/daemon/lldp.c
index 7dcfabf22d0b582f2b6c62f0ab054a95f8dcd82d..0d68e5de21834ae5f3f34ea6d45764f8e2ac279c 100644 (file)
--- a/src/daemon/lldp.c
+++ b/src/daemon/lldp.c
@@ -805,7 +805,7 @@ lldp_decode(struct lldpd *cfg, char *frame, int s,
                                                goto malformed;
                                        }
                                        pi->p_pi_len = PEEK_UINT8;
-                                       CHECK_TLV_SIZE(1 + pi->p_pi_len, "PI");
+                                       CHECK_TLV_SIZE(5 + pi->p_pi_len, "PI");
                                        if ((pi->p_pi =
                                                (char *)calloc(1, pi->p_pi_len)) == NULL) {
                                                log_warn("lldp", "unable to alloc pid name for "