From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 30 Oct 2019 18:11:04 +0000 (-0400)
Subject: check option length correctly
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=93d588fa1c871d77664c425ccc5cfbbb47e1fcce;p=thirdparty%2Ffreeradius-server.git

check option length correctly
---

diff --git a/src/protocols/dhcpv4/decode.c b/src/protocols/dhcpv4/decode.c
index 54f3c6f391f..c25baf6bba4 100644
--- a/src/protocols/dhcpv4/decode.c
+++ b/src/protocols/dhcpv4/decode.c
@@ -396,7 +396,7 @@ ssize_t fr_dhcpv4_decode_option(TALLOC_CTX *ctx, fr_cursor_t *cursor,
 	/*
 	 *	Everything else should be real options
 	 */
-	if ((data_len < 2) || (data[1] > data_len)) {
+	if ((data_len < 2) || ((data[1] + 2) > data_len)) {
 		fr_strerror_printf("%s: Insufficient data", __FUNCTION__);
 		return -1;
 	}