Use offsetof() instead of sizeof() to get the sizes for dhcpv6_relay_packet

and dhcpv6_packet in several more places.  Thanks to a report from
Bruno Verstuyft and Vincent Demaertelaere of Excentis.
[ISC-Bugs #27941]

diff --git a/RELNOTES b/RELNOTES
index b845c2be789e5bc2c8473c577c42c56dbafb69ee..eb28b9f967e1f540d6d7f4b881308fcc8af934df 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -104,6 +104,11 @@ work on other platforms. Please report any problems and suggested fixes to
   weren't removed from the DNS.
   [ISC-BUGS #27858]
 
+- Use offsetof() instead of sizeof() to get the sizes for dhcpv6_relay_packet
+  and dhcpv6_packet in several more places.  Thanks to a report from
+  Bruno Verstuyft and Vincent Demaertelaere of Excentis.
+  [ISC-Bugs #27941]
+
                        Changes since 4.2.2
 
 - Fix the code that checks for an existing DDNS transaction to cancel

diff --git a/common/options.c b/common/options.c
index 3c08d33beceb0433de398641c05abd0e5a6a6601..e21992d2be940349ffad362369578c6bf81267b6 100644 (file)
--- a/common/options.c
+++ b/common/options.c
@@ -3845,6 +3845,7 @@ do_packet6(struct interface_info *interface, const char *packet,
        msg_type = packet[0];
        if ((msg_type == DHCPV6_RELAY_FORW) || 
            (msg_type == DHCPV6_RELAY_REPL)) {
+               int relaylen = (int)(offsetof(struct dhcpv6_relay_packet, options));
                relay = (const struct dhcpv6_relay_packet *)packet;
                decoded_packet->dhcpv6_msg_type = relay->msg_type;
 
@@ -3856,7 +3857,7 @@ do_packet6(struct interface_info *interface, const char *packet,
                       relay->peer_address, sizeof(relay->peer_address));
 
                if (!parse_option_buffer(decoded_packet->options, 
-                                        relay->options, len-sizeof(*relay), 
+                                        relay->options, len - relaylen, 
                                         &dhcpv6_universe)) {
                        /* no logging here, as parse_option_buffer() logs all
                           cases where it fails */
@@ -3864,6 +3865,7 @@ do_packet6(struct interface_info *interface, const char *packet,
                        return;
                }
        } else {
+               int msglen = (int)(offsetof(struct dhcpv6_packet, options));
                msg = (const struct dhcpv6_packet *)packet;
                decoded_packet->dhcpv6_msg_type = msg->msg_type;
 
@@ -3873,7 +3875,7 @@ do_packet6(struct interface_info *interface, const char *packet,
                       sizeof(decoded_packet->dhcpv6_transaction_id));
 
                if (!parse_option_buffer(decoded_packet->options, 
-                                        msg->options, len-sizeof(*msg), 
+                                        msg->options, len - msglen, 
                                         &dhcpv6_universe)) {
                        /* no logging here, as parse_option_buffer() logs all
                           cases where it fails */

diff --git a/server/dhcpv6.c b/server/dhcpv6.c
index 3e7a9807efbc296eb281a8b5d8321d50a67cbf15..336b3a07dcf5009d3e951aa5420a1c265166f02f 100644 (file)
--- a/server/dhcpv6.c
+++ b/server/dhcpv6.c
@@ -5527,6 +5527,7 @@ dhcpv6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
        msg_type = enc_opt_data.data[0];
        if ((msg_type == DHCPV6_RELAY_FORW) ||
            (msg_type == DHCPV6_RELAY_REPL)) {
+               int relaylen = (int)(offsetof(struct dhcpv6_relay_packet, options));
                relay = (struct dhcpv6_relay_packet *)enc_opt_data.data;
                enc_packet->dhcpv6_msg_type = relay->msg_type;
 
@@ -5539,13 +5540,14 @@ dhcpv6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
 
                if (!parse_option_buffer(enc_packet->options,
                                         relay->options, 
-                                        enc_opt_data.len-sizeof(*relay),
+                                        enc_opt_data.len - relaylen,
                                         &dhcpv6_universe)) {
                        /* no logging here, as parse_option_buffer() logs all
                           cases where it fails */
                        goto exit;
                }
        } else {
+               int msglen = (int)(offsetof(struct dhcpv6_packet, options));
                msg = (struct dhcpv6_packet *)enc_opt_data.data;
                enc_packet->dhcpv6_msg_type = msg->msg_type;
 
@@ -5556,7 +5558,7 @@ dhcpv6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
 
                if (!parse_option_buffer(enc_packet->options,
                                         msg->options, 
-                                        enc_opt_data.len-sizeof(*msg),
+                                        enc_opt_data.len - msglen,
                                         &dhcpv6_universe)) {
                        /* no logging here, as parse_option_buffer() logs all
                           cases where it fails */