We should check start len >0 as len will be zero at this point.

diff --git a/dhcp.c b/dhcp.c
index da62070517299b4b355252fb76ee61f42d74ed79..ca564fcb3856dfec6f22c04416b66cb3dfc7a18c 100644 (file)
--- a/dhcp.c
+++ b/dhcp.c
@@ -440,11 +440,13 @@ ssize_t
 decode_rfc3397(char *out, ssize_t len, int pl, const uint8_t *p)
 {
        const char *start;
+       ssize_t start_len;
        const uint8_t *r, *q = p;
        int count = 0, l, hops;
        uint8_t ltype;
 
        start = out;
+       start_len = len;
        while (q - p < pl) {
                r = NULL;
                hops = 0;
@@ -494,7 +496,7 @@ decode_rfc3397(char *out, ssize_t len, int pl, const uint8_t *p)
        if (out) {
                if (out != start)
                        *(out - 1) = '\0';
-               else if (len > 0)
+               else if (start_len > 0)
                        *out = '\0';
        }