Fix off-by-one in DHCPv6 FQDN option decoding.

diff --git a/src/rfc3315.c b/src/rfc3315.c
index 377bacca09f44955893945c3df18f1df9b60ffd2..730fdfe99a083e1fe8443ef741a6403fd07a83da 100644 (file)
--- a/src/rfc3315.c
+++ b/src/rfc3315.c
@@ -349,28 +349,28 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 
        if (len != 0 && len < 255)
         {
-         unsigned char *pp, *op = opt6_ptr(opt, 1);
-         char *pq = daemon->dhcp_buff;
-         
-         pp = op;
-         while (*op != 0 && ((op + (*op) + 1) - pp) < len)
-           {
-            memcpy(pq, op+1, *op);
-            pq += *op;
-            op += (*op)+1;
-            *(pq++) = '.';
-           }
-         
-         if (pq != daemon->dhcp_buff)
-           pq--;
-         *pq = 0;
-
-         if (legal_hostname(daemon->dhcp_buff))
-           {
-             client_hostname = daemon->dhcp_buff;
-             if (option_bool(OPT_LOG_OPTS))
-               my_syslog(MS_DHCP | LOG_INFO, _("%u client provides name: %s"), xid, client_hostname); 
-           }
+          unsigned char *pp, *op = opt6_ptr(opt, 1);
+          char *pq = daemon->dhcp_buff;
+          
+          pp = op;
+          while (*op != 0 && ((op + (*op)) - pp) < len)
+            {
+              memcpy(pq, op+1, *op);
+              pq += *op;
+              op += (*op)+1;
+              *(pq++) = '.';
+            }
+          
+          if (pq != daemon->dhcp_buff)
+            pq--;
+          *pq = 0;
+          
+          if (legal_hostname(daemon->dhcp_buff))
+            {
+              client_hostname = daemon->dhcp_buff;
+              if (option_bool(OPT_LOG_OPTS))
+                my_syslog(MS_DHCP | LOG_INFO, _("%u client provides name: %s"), xid, client_hostname); 
+            }
         }
     }