From: Roy Marples <roy@marples.name>
Date: Wed, 24 Oct 2012 12:13:55 +0000 (+0000)
Subject: More fixes to validation lengths.
X-Git-Tag: v5.99.3~54
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b47baaa14b09d23961cf9e83fb8033bc3c822a50;p=thirdparty%2Fdhcpcd.git

More fixes to validation lengths.
---

diff --git a/dhcp.c b/dhcp.c
index 25431ff6..b1b66740 100644
--- a/dhcp.c
+++ b/dhcp.c
@@ -234,8 +234,11 @@ validate_length(uint8_t option, int dl, int *type)
 		    opt->type & (STRING | RFC3442 | RFC5969))
 			return dl;
 
-		if (opt->type & IPV4 && opt->type & ARRAY)
-			return (dl % sizeof(uint32_t) == 0 ? 0 : -1);
+		if (opt->type & IPV4 && opt->type & ARRAY) {
+			if (dl < (int)sizeof(uint32_t))
+				return -1;
+			return dl - (dl % sizeof(uint32_t));
+		}
 
 		sz = 0;
 		if (opt->type & (UINT32 | IPV4))
@@ -247,7 +250,7 @@ validate_length(uint8_t option, int dl, int *type)
 		/* If we don't know the size, assume it's valid */
 		if (sz == 0)
 			return dl;
-		return sz;
+		return (sz < dl ? -1 : sz);
 	}
 
 	/* unknown option, so let it pass */