Check for unsupported PD exclusion configuration in dhcpv6_parse_ia

We currently only support PD exclusions that only affect bits 64-95 of
the address, so we require:

    32 <= PD prefix length < exclusion prefix length <= 64

The first inequality was not validated, and this could result in a
buffer overflow when generating the next request message.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/src/dhcpv6.c b/src/dhcpv6.c
index c2a3e3d630a6fb42e0db54696cef2b3b9417cde7..2d8124f288171f966e777720254c401d7d3b14ce 100644 (file)
--- a/src/dhcpv6.c
+++ b/src/dhcpv6.c
@@ -1185,7 +1185,7 @@ static int dhcpv6_parse_ia(void *opt, void *end)
                                if (elen > 64)
                                        elen = 64;
 
-                               if (elen <= 32 || elen <= entry.length) {
+                               if (entry.length < 32 || elen <= entry.length) {
                                        ok = false;
                                        continue;
                                }