diff options
Diffstat (limited to 'net/dhcpv6.c')
| -rw-r--r-- | net/dhcpv6.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/dhcpv6.c b/net/dhcpv6.c index 0d1c600632f..73a1067877c 100644 --- a/net/dhcpv6.c +++ b/net/dhcpv6.c @@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len) option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr); option_len = ntohs(option_hdr->option_len); + if (option_ptr + option_len > rx_pkt + len) { + debug("Invalid option length\n"); + return; + } + switch (ntohs(option_hdr->option_id)) { case DHCP6_OPTION_CLIENTID: if (memcmp(option_ptr, sm_params.duid, option_len) |