From cb1bdeaf56852275e6b0dd1fba932bb174767f70 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 27 Sep 2018 23:48:51 +0900 Subject: [PATCH] dhcp6: fix buffer size checking --- src/libsystemd-network/sd-dhcp6-client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c index 6e7ccce6dc8..78994364cb2 100644 --- a/src/libsystemd-network/sd-dhcp6-client.c +++ b/src/libsystemd-network/sd-dhcp6-client.c @@ -844,8 +844,8 @@ static int client_parse_message( uint8_t *optval; be32_t iaid_lease; - if (len < offsetof(DHCP6Option, data) || - len < offsetof(DHCP6Option, data) + be16toh(option->len)) + if (len < pos + offsetof(DHCP6Option, data) || + len < pos + offsetof(DHCP6Option, data) + be16toh(option->len)) return -ENOBUFS; optcode = be16toh(option->code); -- 2.47.3