From: Francis Dupont <fdupont@isc.org>
Date: Wed, 12 Aug 2026 13:41:33 +0000 (+0200)
Subject: [#4735] Addressed relay with empty body
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ef4be552b559f75ddb866f57703d87c3eca4dedd;p=thirdparty%2Fkea.git

[#4735] Addressed relay with empty body
---

diff --git a/src/lib/dhcp/pkt6.cc b/src/lib/dhcp/pkt6.cc
index 18684ae50e..fc1c20c46f 100644
--- a/src/lib/dhcp/pkt6.cc
+++ b/src/lib/dhcp/pkt6.cc
@@ -570,6 +570,12 @@ Pkt6::unpackRelayMsg() {
         offset += isc::asiolink::V6ADDRESS_LEN;
         bufsize -= DHCPV6_RELAY_HDR_LEN; // 34 bytes (1+1+16+16)
 
+        // We just avoid to go out of bounds but we could use the minimal
+        // room for the relay-msg option...
+        if (bufsize == 0) {
+            isc_throw(BadValue, "Mandatory options missing");
+        }
+
         // parse the rest as options
         OptionBuffer opt_buffer(&data_[offset], &data_[offset] + bufsize);
 
diff --git a/src/lib/dhcp/tests/pkt6_unittest.cc b/src/lib/dhcp/tests/pkt6_unittest.cc
index 429ddda5a3..40a03be513 100644
--- a/src/lib/dhcp/tests/pkt6_unittest.cc
+++ b/src/lib/dhcp/tests/pkt6_unittest.cc
@@ -2471,4 +2471,18 @@ TEST_F(Pkt6Test, garbageRelayForw) {
     EXPECT_THROW(pkt->unpack(), Unexpected);
 }
 
+// Checks that RELAY-FORW with empty body is dropped.
+TEST_F(Pkt6Test, emptyRelayForw) {
+    // Reuse packet from the previous test keeping just the relay-forw header.
+    string hex_string =
+        "0c00fd4a3b1c8d9e00230000000000000001"
+        "fe80000000000000deadbeefcafe0001";
+    vector<uint8_t> bin;
+    ASSERT_NO_THROW(isc::util::encode::decodeHex(hex_string, bin));
+    EXPECT_EQ(34U, bin.size());
+    Pkt6Ptr pkt(new Pkt6(&bin[0], bin.size()));
+    ASSERT_TRUE(pkt);
+    EXPECT_THROW(pkt->unpack(), BadValue);
+}
+
 }  // namespace