Drop DHCPv6 messages containing invalid option length
authorHans Dedecker <dedeckeh@gmail.com>
Fri, 27 Dec 2013 14:55:24 +0000 (15:55 +0100)
committerHans Dedecker <dedeckeh@gmail.com>
Fri, 27 Dec 2013 14:55:24 +0000 (15:55 +0100)
src/dhcpv6.c

index cd8e43800dca33315047cd000262a5697c985be5..8d65219eb8d4ccfe073ab214750aef49f9f9380a 100644 (file)
@@ -623,7 +623,7 @@ static bool dhcpv6_response_is_valid(const void *buf, ssize_t len,
                }
        }
 
-       if (!options_valid)
+       if (!options_valid || ((odata + olen) > end))
                return false;
 
        if (type == DHCPV6_MSG_INFO_REQ && ia_present)