]> git.ipfire.org Git - thirdparty/freeradius-server.git/commitdiff
overflow check correction, typo in error message
authorCatalina Pineros <catalina.pineros@inkbridge.io>
Tue, 10 Mar 2026 13:56:24 +0000 (09:56 -0400)
committerAlan T. DeKok <aland@freeradius.org>
Wed, 11 Mar 2026 18:07:17 +0000 (14:07 -0400)
when parsing string (   static int read_string(rlm_isc_dhcp_tokenizer_t *state)   )
if string is of size 255,
then '/0' is added at position 256, which is an overflow error
so ((size_t) (q - state->string) >= sizeof(state->string) -1 )  necessary to preserve space for the null terminator,

copy-paste mistake.

(found by claude code)

src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c

index 9c7c1275310b97ffa0fee76a336bca413ed3cebc..2faf1679b5bc4999ec5c01df2d5f823199bacf69 100644 (file)
@@ -313,7 +313,7 @@ static int read_string(rlm_isc_dhcp_tokenizer_t *state)
                        }
                }
 
-               if ((size_t) (q - state->string) >= sizeof(state->string)) {
+               if ((size_t) (q - state->string) >= sizeof(state->string) - 1) {
                        fr_strerror_const("string is too long");
                        return -1;
                }
@@ -1686,7 +1686,7 @@ static int parse_filename(UNUSED rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_i
 static int parse_server_name(UNUSED rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info)
 {
        if (info->argv[0]->vb_length > member_size(dhcp_packet_t, sname)) {
-               fr_strerror_const("filename is too long");
+               fr_strerror_const("server name is too long");
                return -1;
        }