check length

diff --git a/src/protocols/dhcpv4/decode.c b/src/protocols/dhcpv4/decode.c
index e1d1db33c58b2f787e1ba9b9b19d8789c7590d39..ab365f60e7a0ba5ac84b32070106e9d4f19484f9 100644 (file)
--- a/src/protocols/dhcpv4/decode.c
+++ b/src/protocols/dhcpv4/decode.c
@@ -268,8 +268,9 @@ static ssize_t decode_tlv(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_attr_t c
                }
 
                if ((p[1] + 2) > (end - p)) {
-                       fr_strerror_printf("%s: Suboption would overflow option.  Remaining option data %zu byte(s) "
-                                          "(from %zu), Suboption length %u", __FUNCTION__, (end - p), data_len, p[1]);
+                       fr_strerror_printf("%s: Suboption %02x would overflow option.  Remaining option data %zu byte(s) "
+                                          "(from %zu), Suboption length %u",
+                                          __FUNCTION__, p[0], (end - p), data_len, p[1]);
                        return -1;
                }
 

diff --git a/src/protocols/dhcpv4/packet.c b/src/protocols/dhcpv4/packet.c
index ae2e116021ea1063329b0c76baea81e0e085fa8f..b7d8fe6b35531fd6efb78671bedea73c2387ad1a 100644 (file)
--- a/src/protocols/dhcpv4/packet.c
+++ b/src/protocols/dhcpv4/packet.c
@@ -286,7 +286,7 @@ int fr_dhcpv4_packet_decode(RADIUS_PACKET *packet)
                         *      Vendor is "MSFT 98"
                         */
                        vp = fr_pair_find_by_da(head, attr_dhcp_vendor_class_identifier, TAG_ANY);
-                       if (vp && (strcmp(vp->vp_strvalue, "MSFT 98") == 0)) {
+                       if (vp && (vp->vp_length == 7) && (memcmp(vp->vp_strvalue, "MSFT 98", 7) == 0)) {
                                vp = fr_pair_find_by_da(head, attr_dhcp_flags, TAG_ANY);
 
                                /*