From: Roy Marples <roy@marples.name>
Date: Sat, 20 Jun 2026 17:14:30 +0000 (+0100)
Subject: DHCP6: Ensure IA_PD Prefix Length is valid
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a92f79b03461b2a5a86967ffa9e1f17d1402e832;p=thirdparty%2Fdhcpcd.git

DHCP6: Ensure IA_PD Prefix Length is valid

Reported by NVIDIA Project Vanessa
---

diff --git a/src/dhcp6.c b/src/dhcp6.c
index a061d0bd..61a90633 100644
--- a/src/dhcp6.c
+++ b/src/dhcp6.c
@@ -2311,6 +2311,13 @@ dhcp6_findpd(struct interface *ifp, const uint8_t *iaid, uint8_t *d, size_t l,
 		memcpy(&pdp_plen, o, sizeof(pdp_plen));
 		o += sizeof(pdp_plen);
 
+		if (pdp_plen > 128) {
+			errno = EINVAL;
+			logerrx("%s: IA Prefix length %u invalid", ifp->name,
+			    pdp_plen);
+			continue;
+		}
+
 		pdp_pltime = ntohl(pdp_pltime);
 		pdp_vltime = ntohl(pdp_vltime);
 		/* RFC 3315 22.6 */