it helps to check if there's room for the header.

diff --git a/src/protocols/dhcpv4/decode.c b/src/protocols/dhcpv4/decode.c
index 20ce648a05eb98ce57ddb66dd62635044a15626f..120db27aa002e2070ebd11ba54d3291eda0ac5a7 100644 (file)
--- a/src/protocols/dhcpv4/decode.c
+++ b/src/protocols/dhcpv4/decode.c
@@ -682,6 +682,7 @@ ssize_t fr_dhcpv4_decode_option(TALLOC_CTX *ctx, fr_pair_list_t *out,
                q = packet_ctx->buffer;
 
                for (next = data; next < end; next += 2 + next[1]) {
+                       if ((end - next) < 2) return -1;
                        if (next[0] != data[0]) break;
                        if ((next + 2 + next[1]) > end) return -1;