dhcp-server: fix integer underflow

Let's better ignore an invalid message size parameter, than assume ridiculously
larger sizes.

diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
index a1af5da40ff773656bd1153971231fdd5fac958c..ea4f03df1d5fe881e496ddd3433f4ef5ca34fde0 100644 (file)
--- a/src/libsystemd-network/sd-dhcp-server.c
+++ b/src/libsystemd-network/sd-dhcp-server.c
@@ -633,7 +633,8 @@ static int parse_request(uint8_t code, uint8_t len, const void *option, void *us
 
                 break;
         case SD_DHCP_OPTION_MAXIMUM_MESSAGE_SIZE:
-                if (len == 2)
+
+                if (len == 2 && unaligned_read_be16(option) >= sizeof(DHCPPacket))
                         req->max_optlen = unaligned_read_be16(option) - sizeof(DHCPPacket);
 
                 break;