diff options
| author | Thomas Markwalder <tmark@isc.org> | 2019-12-20 11:34:49 -0500 |
|---|---|---|
| committer | Thomas Markwalder <tmark@isc.org> | 2019-12-20 11:34:49 -0500 |
| commit | b68402e0bbb4943b84149cc21cbb3ec20cc07318 (patch) | |
| tree | 9f578b27c09d6a7d0355b015a02bf016e0327f93 | |
| parent | b69469ce8ada6b3a5548b46fd563555546e83c86 (diff) | |
| download | isc-dhcp-b68402e0bbb4943b84149cc21cbb3ec20cc07318.tar.gz | |
[#71] Fixed buffer pointer logic in dhcrelay.c
dhcrelay.c
strip_relay_agent_options
add_relay_agent_options
- corrected buffer pointer logic
| -rw-r--r-- | relay/dhcrelay.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/relay/dhcrelay.c b/relay/dhcrelay.c index 407b4818..36a891a5 100644 --- a/relay/dhcrelay.c +++ b/relay/dhcrelay.c @@ -880,8 +880,13 @@ strip_relay_agent_options(struct interface_info *in, return (0); if (sp != op) { - memmove(sp, op, op[1] + 2); - sp += op[1] + 2; + size_t mlen = op[1] + 2; + memmove(sp, op, mlen); + sp += mlen; + if (sp > max) { + return (0); + } + op = nextop; } else op = sp = nextop; @@ -1104,8 +1109,13 @@ add_relay_agent_options(struct interface_info *ip, struct dhcp_packet *packet, end_pad = NULL; if (sp != op) { - memmove(sp, op, op[1] + 2); - sp += op[1] + 2; + size_t mlen = op[1] + 2; + memmove(sp, op, mlen); + sp += mlen; + if (sp > max) { + return (0); + } + op = nextop; } else op = sp = nextop; |