check option length correctly

diff --git a/src/protocols/dhcpv4/decode.c b/src/protocols/dhcpv4/decode.c
index 54f3c6f391ff46bc1dc3d74c37b7d3e14470624b..c25baf6bba4b09ae36ada8e448d59a22bf4761b2 100644 (file)
--- a/src/protocols/dhcpv4/decode.c
+++ b/src/protocols/dhcpv4/decode.c
@@ -396,7 +396,7 @@ ssize_t fr_dhcpv4_decode_option(TALLOC_CTX *ctx, fr_cursor_t *cursor,
        /*
         *      Everything else should be real options
         */
-       if ((data_len < 2) || (data[1] > data_len)) {
+       if ((data_len < 2) || ((data[1] + 2) > data_len)) {
                fr_strerror_printf("%s: Insufficient data", __FUNCTION__);
                return -1;
        }