From: Yu Watanabe Date: Mon, 22 Feb 2021 12:59:24 +0000 (+0900) Subject: dhcp6: do not use input value before checking X-Git-Tag: v248-rc3~127^2~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cf6c33bd6b6ca606f0756312bd73ae066c6aa9a8;p=thirdparty%2Fsystemd.git dhcp6: do not use input value before checking --- diff --git a/src/libsystemd-network/dhcp6-option.c b/src/libsystemd-network/dhcp6-option.c index 9f47c1bbe4c..48eef8950b6 100644 --- a/src/libsystemd-network/dhcp6-option.c +++ b/src/libsystemd-network/dhcp6-option.c @@ -41,14 +41,15 @@ typedef struct DHCP6PDPrefixOption { #define DHCP6_OPTION_IA_PD_LEN (sizeof(struct ia_pd)) #define DHCP6_OPTION_IA_TA_LEN (sizeof(struct ia_ta)) -static int option_append_hdr(uint8_t **buf, size_t *buflen, uint16_t optcode, - size_t optlen) { - DHCP6Option *option = (DHCP6Option*) *buf; +static int option_append_hdr(uint8_t **buf, size_t *buflen, uint16_t optcode, size_t optlen) { + DHCP6Option *option; assert_return(buf, -EINVAL); assert_return(*buf, -EINVAL); assert_return(buflen, -EINVAL); + option = (DHCP6Option*) *buf; + if (optlen > 0xffff || *buflen < optlen + offsetof(DHCP6Option, data)) return -ENOBUFS;