From: Hans Dedecker <dedeckeh@gmail.com>
Date: Mon, 7 May 2018 15:59:47 +0000 (+0200)
Subject: dhcpv4: fix out of bound access in dhcpv4_put
X-Git-Url: http://git.openwrt.org/?p=project%2Fodhcpd.git;a=commitdiff_plain;h=710f2ab5c9891d654985f605d5a09061137d8731

dhcpv4: fix out of bound access in dhcpv4_put

Detected by Coverity in CID 1433363 and 1432121

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
---

diff --git a/src/dhcpv4.c b/src/dhcpv4.c
index 81e537d..88727ac 100644
--- a/src/dhcpv4.c
+++ b/src/dhcpv4.c
@@ -241,7 +241,9 @@ static void dhcpv4_put(struct dhcpv4_message *msg, uint8_t **cookie,
 		uint8_t type, uint8_t len, const void *data)
 {
 	uint8_t *c = *cookie;
-	if (*cookie + 2 + len > (uint8_t*)&msg[1])
+	uint8_t *end = (uint8_t *)msg + sizeof(*msg);
+
+	if (*cookie + 2 + len > end)
 		return;
 
 	*c++ = type;