From: Roy Marples <roy@marples.name>
Date: Wed, 14 Nov 2012 10:13:56 +0000 (+0000)
Subject: More fixes to validation lengths.
X-Git-Tag: v5.6.3~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b44e21ed573346cea850ed59cdbfdd74ddaaf00;p=thirdparty%2Fdhcpcd.git

More fixes to validation lengths.
---

diff --git a/dhcp.c b/dhcp.c
index acc2b54c..660d31d1 100644
--- a/dhcp.c
+++ b/dhcp.c
@@ -272,8 +272,11 @@ validate_length(uint8_t option, int dl, int *type)
 		    opt->type & (STRING | RFC3442 | RFC5969))
 			return dl;
 
-		if (opt->type & IPV4 && opt->type & ARRAY)
-			return (dl % sizeof(uint32_t) == 0 ? 0 : -1);
+		if (opt->type & IPV4 && opt->type & ARRAY) {
+			if (dl < (int)sizeof(uint32_t))
+				return -1;
+			return dl - (dl % sizeof(uint32_t));
+		}
 
 		sz = 0;
 		if (opt->type & (UINT32 | IPV4))
@@ -285,7 +288,7 @@ validate_length(uint8_t option, int dl, int *type)
 		/* If we don't know the size, assume it's valid */
 		if (sz == 0)
 			return dl;
-		return sz;
+		return (sz < dl ? -1 : sz);
 	}
 
 	/* unknown option, so let it pass */