From: Roy Marples <roy@marples.name>
Date: Sat, 20 Jun 2026 13:14:43 +0000 (+0100)
Subject: options: Fix userclass boundary
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;ds=inline;p=thirdparty%2Fdhcpcd.git

options: Fix userclass boundary

Reported by NVIDIA Project Vanessa
---

diff --git a/src/if-options.c b/src/if-options.c
index 03aae3d5..9d644827 100644
--- a/src/if-options.c
+++ b/src/if-options.c
@@ -875,7 +875,12 @@ parse_option(struct dhcpcd_ctx *ctx, const char *ifname, struct if_options *ifo,
 		}
 		break;
 	case 'u':
-		dl = sizeof(ifo->userclass) - ifo->userclass[0] - 1;
+		if ((size_t)ifo->userclass[0] + 2 > sizeof(ifo->userclass)) {
+			errno = ENOBUFS;
+			logerr("userclass");
+			return -1;
+		}
+		dl = sizeof(ifo->userclass) - ifo->userclass[0] - 2;
 		s = parse_string((char *)ifo->userclass + ifo->userclass[0] + 2,
 		    dl, arg);
 		if (s == -1) {