From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 2 Oct 2020 03:28:36 +0000 (-0500)
Subject: dhcpv6: Don't return 0 on error
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=75e772f51389c6eba6f9ffc89eb80bfe0ea25657;p=thirdparty%2Ffreeradius-server.git

dhcpv6: Don't return 0 on error
---

diff --git a/src/protocols/dhcpv6/decode.c b/src/protocols/dhcpv6/decode.c
index 3237ef6276d..e335ba60e29 100644
--- a/src/protocols/dhcpv6/decode.c
+++ b/src/protocols/dhcpv6/decode.c
@@ -519,9 +519,11 @@ static ssize_t decode_option(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t con
 
 	option = (data[0] << 8) | data[1];
 	len = (data[2] << 8) | data[3];
-	if ((len + 4) > data_len) {
-		fr_strerror_printf("%s: Option overflows input", __FUNCTION__);
-		return 0;
+	if (len > (data_len - 4)) {
+		fr_strerror_printf("%s: Option overflows input.  "
+				   "Optional length must be less than %zu bytes, got %zu bytes",
+				   __FUNCTION__, data_len - 4, len);
+		return PAIR_DECODE_FATAL_ERROR;
 	}
 
 	da = fr_dict_attr_child_by_num(parent, option);