options: Fix userclass boundary

Reported by NVIDIA Project Vanessa

diff --git a/src/if-options.c b/src/if-options.c
index 03aae3d5cde6d10396cf71d0619f6184f51956da..9d644827a79cafde0c237689401ad7f3fa19210d 100644 (file)
--- a/src/if-options.c
+++ b/src/if-options.c
@@ -875,7 +875,12 @@ parse_option(struct dhcpcd_ctx *ctx, const char *ifname, struct if_options *ifo,
                }
                break;
        case 'u':
-               dl = sizeof(ifo->userclass) - ifo->userclass[0] - 1;
+               if ((size_t)ifo->userclass[0] + 2 > sizeof(ifo->userclass)) {
+                       errno = ENOBUFS;
+                       logerr("userclass");
+                       return -1;
+               }
+               dl = sizeof(ifo->userclass) - ifo->userclass[0] - 2;
                s = parse_string((char *)ifo->userclass + ifo->userclass[0] + 2,
                    dl, arg);
                if (s == -1) {