lldp: fix boundary checks when decoding LLDP management address

diff --git a/src/daemon/lldp.c b/src/daemon/lldp.c
index 5b0e4771feb1d499f892e7f9c87ca7be7f7df8cb..7dcfabf22d0b582f2b6c62f0ab054a95f8dcd82d 100644 (file)
--- a/src/daemon/lldp.c
+++ b/src/daemon/lldp.c
@@ -703,12 +703,12 @@ lldp_decode(struct lldpd *cfg, char *frame, int s,
                case LLDP_TLV_MGMT_ADDR:
                        CHECK_TLV_SIZE(1, "Management address");
                        addr_str_length = PEEK_UINT8;
-                       CHECK_TLV_SIZE(addr_str_length, "Management address");
+                       CHECK_TLV_SIZE(1 + addr_str_length, "Management address");
                        PEEK_BYTES(addr_str_buffer, addr_str_length);
                        addr_length = addr_str_length - 1;
                        addr_family = addr_str_buffer[0];
                        addr_ptr = &addr_str_buffer[1];
-                       CHECK_TLV_SIZE(5, "Management address");
+                       CHECK_TLV_SIZE(1 + addr_str_length + 5, "Management address");
                        iface_subtype = PEEK_UINT8;
                        iface_number = PEEK_UINT32;