From: Hans Dedecker <dedeckeh@gmail.com>
Date: Thu, 7 Jun 2018 20:36:29 +0000 (+0200)
Subject: dhcpv6: fix out of bounds write in handle_nested_message()
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=c45e2eb865cffd3d2556efc39de02c9b0c56b79b;p=project%2Fodhcpd.git

dhcpv6: fix out of bounds write in handle_nested_message()

Detected by Coverity in CID1412413

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
---

diff --git a/src/dhcpv6.c b/src/dhcpv6.c
index 4e7d0d0..5549394 100644
--- a/src/dhcpv6.c
+++ b/src/dhcpv6.c
@@ -174,7 +174,7 @@ enum {
 };
 
 static void handle_nested_message(uint8_t *data, size_t len,
-		uint8_t **opts, uint8_t **end, struct iovec iov[IOV_TOTAL - 1])
+		uint8_t **opts, uint8_t **end, struct iovec iov[IOV_TOTAL])
 {
 	struct dhcpv6_relay_header *hdr = (struct dhcpv6_relay_header*)data;
 	if (iov[IOV_NESTED].iov_base == NULL) {