From 8d11b33f6c60e2db257130fa383ba76b6018bcf6 Mon Sep 17 00:00:00 2001 From: Roy Marples Date: Fri, 19 Apr 2019 09:45:02 +0100 Subject: [PATCH] DHCPv6: Fix a potential buffer overflow reading NA/TA addresses Only copy upto the size of the address option rather than the option length. Found by Maxime Villard --- src/dhcp6.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/dhcp6.c b/src/dhcp6.c index 99a452bb..8fc4f000 100644 --- a/src/dhcp6.c +++ b/src/dhcp6.c @@ -2029,12 +2029,12 @@ dhcp6_findna(struct interface *ifp, uint16_t ot, const uint8_t *iaid, nd = o + ol; l -= (size_t)(nd - d); d = nd; - if (ol < 24) { + if (ol < sizeof(ia)) { errno = EINVAL; logerrx("%s: IA Address option truncated", ifp->name); continue; } - memcpy(&ia, o, ol); + memcpy(&ia, o, sizeof(ia)); ia.pltime = ntohl(ia.pltime); ia.vltime = ntohl(ia.vltime); /* RFC 3315 22.6 */ -- 2.21.0