From 26c5d8724355b29694af684ee29b47e52129a33c Mon Sep 17 00:00:00 2001 From: Hans Dedecker Date: Thu, 12 Dec 2013 17:05:25 +0100 Subject: Fix handling of DHCPv6 messages containing option lengths exceeding the message --- src/odhcp6c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/odhcp6c.h') diff --git a/src/odhcp6c.h b/src/odhcp6c.h index 15be59a..8771521 100644 --- a/src/odhcp6c.h +++ b/src/odhcp6c.h @@ -155,7 +155,7 @@ struct dhcpv6_auth_reconfigure { #define dhcpv6_for_each_option(start, end, otype, olen, odata)\ for (uint8_t *_o = (uint8_t*)(start); _o + 4 <= (uint8_t*)(end) &&\ ((otype) = _o[0] << 8 | _o[1]) && ((odata) = (void*)&_o[4]) &&\ - ((olen) = _o[2] << 8 | _o[3]) + (odata) <= (uint8_t*)(end); \ + ((olen) = _o[2] << 8 | _o[3]); \ _o += 4 + (_o[2] << 8 | _o[3])) -- cgit v1.2.1