DHCP6: Ensure IA_PD Prefix Length is valid

Reported by NVIDIA Project Vanessa

diff --git a/src/dhcp6.c b/src/dhcp6.c
index a061d0bda64035b04303234f45dfc425fb52303c..61a90633f36ec646899bf2c2911c4bb479bc8306 100644 (file)
--- a/src/dhcp6.c
+++ b/src/dhcp6.c
@@ -2311,6 +2311,13 @@ dhcp6_findpd(struct interface *ifp, const uint8_t *iaid, uint8_t *d, size_t l,
                memcpy(&pdp_plen, o, sizeof(pdp_plen));
                o += sizeof(pdp_plen);
 
+               if (pdp_plen > 128) {
+                       errno = EINVAL;
+                       logerrx("%s: IA Prefix length %u invalid", ifp->name,
+                           pdp_plen);
+                       continue;
+               }
+
                pdp_pltime = ntohl(pdp_pltime);
                pdp_vltime = ntohl(pdp_vltime);
                /* RFC 3315 22.6 */