sd-radv: fix potential buffer overflow

Fixes a bug in 1925f829ab17cee7d65cc8c350d8281f8f41588e and
6a6d27bc5b08388964118e922f0c1b49b3c6a8ae (v255).

diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c
index 511d06d8052d42a302d7d98a1e34242d4d93cdc8..97d306c49b2b067039bf77996acf6e8edca57261 100644 (file)
--- a/src/libsystemd-network/sd-radv.c
+++ b/src/libsystemd-network/sd-radv.c
@@ -146,9 +146,9 @@ static int radv_send(sd_radv *ra, const struct in6_addr *dst, usec_t lifetime_us
                 .nd_opt_mtu_type = ND_OPT_MTU,
                 .nd_opt_mtu_len = 1,
         };
-        /* Reserve iov space for RA header, linkaddr, MTU, N prefixes, N routes, RDNSS
-           and DNSSL */
-        struct iovec iov[5 + ra->n_prefixes + ra->n_route_prefixes];
+        /* Reserve iov space for RA header, linkaddr, MTU, N prefixes, N routes, N pref64 prefixes, RDNSS,
+         * DNSSL, and home agent. */
+        struct iovec iov[6 + ra->n_prefixes + ra->n_route_prefixes + ra->n_pref64_prefixes];
         struct msghdr msg = {
                 .msg_name = &dst_addr,
                 .msg_namelen = sizeof(dst_addr),