From: Roy Marples <roy@marples.name>
Date: Thu, 3 Aug 2017 19:22:19 +0000 (+0100)
Subject: Fix a memory issue.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a75398d072f839aa0f7a8f7bd354a0d4a63aeffc;p=thirdparty%2Fdhcpcd.git

Fix a memory issue.
---

diff --git a/src/ipv6nd.c b/src/ipv6nd.c
index 0884c9ab..b7408e9d 100644
--- a/src/ipv6nd.c
+++ b/src/ipv6nd.c
@@ -246,16 +246,16 @@ ipv6nd_makersprobe(struct interface *ifp)
 	state->rs = calloc(1, state->rslen);
 	if (state->rs == NULL)
 		return -1;
-	rs = (void *)state->rs;
+	rs = state->rs;
 	rs->nd_rs_type = ND_ROUTER_SOLICIT;
-	rs->nd_rs_code = 0;
-	rs->nd_rs_cksum = 0;
-	rs->nd_rs_reserved = 0;
+	//rs->nd_rs_code = 0;
+	//rs->nd_rs_cksum = 0;
+	//rs->nd_rs_reserved = 0;
 
 	if (ifp->hwlen != 0) {
 		struct nd_opt_hdr *nd;
 
-		nd = (struct nd_opt_hdr *)(state->rs + sizeof(*rs));
+		nd = (struct nd_opt_hdr *)(state->rs + 1);
 		nd->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
 		nd->nd_opt_len = (uint8_t)((ROUNDUP8(ifp->hwlen + 2)) >> 3);
 		memcpy(nd + 1, ifp->hwaddr, ifp->hwlen);
diff --git a/src/ipv6nd.h b/src/ipv6nd.h
index 17d6c953..fc7751e7 100644
--- a/src/ipv6nd.h
+++ b/src/ipv6nd.h
@@ -55,7 +55,7 @@ struct ra {
 TAILQ_HEAD(ra_head, ra);
 
 struct rs_state {
-	unsigned char *rs;
+	struct nd_router_solicit *rs;
 	size_t rslen;
 	int rsprobes;
 };