dhcpv4: fix out of bound access in dhcpv4_put
authorHans Dedecker <dedeckeh@gmail.com>
Tue, 15 May 2018 20:22:30 +0000 (22:22 +0200)
committerHans Dedecker <dedeckeh@gmail.com>
Tue, 15 May 2018 20:22:30 +0000 (22:22 +0200)
Detected by Coverity in CID 1433363 and 1432121

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
src/dhcpv4.c

index 2b303078bfc8d9b0afd7a8956a47e19a2246af2e..b803359360618ccd103b2bc1c92128a4f7e5c43c 100644 (file)
@@ -493,7 +493,9 @@ static void dhcpv4_put(struct dhcpv4_message *msg, uint8_t **cookie,
                uint8_t type, uint8_t len, const void *data)
 {
        uint8_t *c = *cookie;
-       if (*cookie + 2 + len > (uint8_t*)&msg[1])
+       uint8_t *end = (uint8_t *)msg + sizeof(*msg);
+
+       if (*cookie + 2 + len > end)
                return;
 
        *c++ = type;