diff options
| author | Steven Barth <steven@midlink.org> | 2015-04-14 10:31:10 +0200 |
|---|---|---|
| committer | Steven Barth <steven@midlink.org> | 2015-04-14 10:31:10 +0200 |
| commit | a06dd6481cd046e4856774ac32cdc11f4bc721e2 (patch) | |
| tree | 28ad21b0e6ea51cd1eb9546959ffc20431aaf702 | |
| parent | e23972527f93a3d2a5412400384519ff550708b7 (diff) | |
| download | odhcpd-a06dd6481cd046e4856774ac32cdc11f4bc721e2.tar.gz | |
Fix potential invalid memory access
| -rw-r--r-- | src/dhcpv4.c | 2 | ||||
| -rw-r--r-- | src/dhcpv6-ia.c | 5 |
2 files changed, 5 insertions, 2 deletions
diff --git a/src/dhcpv4.c b/src/dhcpv4.c index 04ef182..647cdc0 100644 --- a/src/dhcpv4.c +++ b/src/dhcpv4.c @@ -637,7 +637,7 @@ static struct dhcpv4_assignment* dhcpv4_lease(struct interface *iface, } else if (msg == DHCPV4_MSG_RELEASE) { if (a && a->valid_until != LONG_MAX) a->valid_until = 0; - } else if (msg == DHCPV4_MSG_DECLINE && a->valid_until != LONG_MAX) { + } else if (msg == DHCPV4_MSG_DECLINE && a && a->valid_until != LONG_MAX) { memset(a->hwaddr, 0, sizeof(a->hwaddr)); a->valid_until = now + 3600; // Block address for 1h } diff --git a/src/dhcpv6-ia.c b/src/dhcpv6-ia.c index de44581..1476e02 100644 --- a/src/dhcpv6-ia.c +++ b/src/dhcpv6-ia.c @@ -596,7 +596,10 @@ static void update(struct interface *iface) } struct dhcpv6_assignment *border = list_last_entry(&iface->ia_assignments, struct dhcpv6_assignment, head); - border->assigned = 1 << (64 - minprefix); + if (minprefix <= 32 || minprefix > 64) + border->assigned = 1U << (64 - minprefix); + else + border->assigned = 0; bool change = len != (int)iface->ia_addr_len; for (int i = 0; !change && i < len; ++i) |