From: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Wed, 14 Apr 2021 08:55:09 +0000 (-0400)
Subject: libsystemd-network: fix dhcp option buffer confusion
X-Git-Tag: v249-rc1~407^2~17
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2d359acda53280489c48d7aee84ba6d53e30a615;p=thirdparty%2Fsystemd.git

libsystemd-network: fix dhcp option buffer confusion

We were writing to the wrong buffer with a wrong offset :(
Bug present since the original introduction of the code in
04b28be1a306fd2ba454d3ee333d63df71aa3873.
---

diff --git a/src/libsystemd-network/dhcp-option.c b/src/libsystemd-network/dhcp-option.c
index faa075cbd71..8899e8a5523 100644
--- a/src/libsystemd-network/dhcp-option.c
+++ b/src/libsystemd-network/dhcp-option.c
@@ -17,6 +17,7 @@
 static int option_append(uint8_t options[], size_t size, size_t *offset,
                          uint8_t code, size_t optlen, const void *optval) {
         assert(options);
+        assert(size > 0);
         assert(offset);
 
         if (code != SD_DHCP_OPTION_END)
@@ -165,7 +166,7 @@ int dhcp_option_append(DHCPMessage *message, size_t size, size_t *offset,
                         } else if (r == -ENOBUFS && use_sname) {
                                 /* did not fit, but we have more buffers to try
                                    close the file array and move the offset to its end */
-                                r = option_append(message->options, size, offset, SD_DHCP_OPTION_END, 0, NULL);
+                                r = option_append(message->file, sizeof(message->file), &file_offset, SD_DHCP_OPTION_END, 0, NULL);
                                 if (r < 0)
                                         return r;