check more option length correctly

diff --git a/src/protocols/dhcpv4/decode.c b/src/protocols/dhcpv4/decode.c
index c25baf6bba4b09ae36ada8e448d59a22bf4761b2..05e5a0ab4a3b66a379bdb515ab30353441bc49ea 100644 (file)
--- a/src/protocols/dhcpv4/decode.c
+++ b/src/protocols/dhcpv4/decode.c
@@ -267,7 +267,7 @@ static ssize_t decode_tlv(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_attr_t c
                        return -1;
                }
 
-               if (p[1] > (end - p)) {
+               if ((p[1] + 2) > (end - p)) {
                        fr_strerror_printf("%s: Suboption would overflow option.  Remaining option data %zu byte(s) "
                                           "(from %zu), Suboption length %u", __FUNCTION__, (end - p), data_len, p[1]);
                        return -1;