[#4735] Addressed relay with empty body

diff --git a/src/lib/dhcp/pkt6.cc b/src/lib/dhcp/pkt6.cc
index 18684ae50e7b2e83e11e72296cfb2d5a93e7f47d..fc1c20c46fbefd6f8ee59f7dbc19eb41f4e816c0 100644 (file)
--- a/src/lib/dhcp/pkt6.cc
+++ b/src/lib/dhcp/pkt6.cc
@@ -570,6 +570,12 @@ Pkt6::unpackRelayMsg() {
         offset += isc::asiolink::V6ADDRESS_LEN;
         bufsize -= DHCPV6_RELAY_HDR_LEN; // 34 bytes (1+1+16+16)
 
+        // We just avoid to go out of bounds but we could use the minimal
+        // room for the relay-msg option...
+        if (bufsize == 0) {
+            isc_throw(BadValue, "Mandatory options missing");
+        }
+
         // parse the rest as options
         OptionBuffer opt_buffer(&data_[offset], &data_[offset] + bufsize);
 

diff --git a/src/lib/dhcp/tests/pkt6_unittest.cc b/src/lib/dhcp/tests/pkt6_unittest.cc
index 429ddda5a3f791741a7c331cc629738b431eafb6..40a03be5131ee91a9bf3ac84f67a959d7b8ba335 100644 (file)
--- a/src/lib/dhcp/tests/pkt6_unittest.cc
+++ b/src/lib/dhcp/tests/pkt6_unittest.cc
@@ -2471,4 +2471,18 @@ TEST_F(Pkt6Test, garbageRelayForw) {
     EXPECT_THROW(pkt->unpack(), Unexpected);
 }
 
+// Checks that RELAY-FORW with empty body is dropped.
+TEST_F(Pkt6Test, emptyRelayForw) {
+    // Reuse packet from the previous test keeping just the relay-forw header.
+    string hex_string =
+        "0c00fd4a3b1c8d9e00230000000000000001"
+        "fe80000000000000deadbeefcafe0001";
+    vector<uint8_t> bin;
+    ASSERT_NO_THROW(isc::util::encode::decodeHex(hex_string, bin));
+    EXPECT_EQ(34U, bin.size());
+    Pkt6Ptr pkt(new Pkt6(&bin[0], bin.size()));
+    ASSERT_TRUE(pkt);
+    EXPECT_THROW(pkt->unpack(), BadValue);
+}
+
 }  // namespace