- dhcpv6_for_each_option(&h[1], oend, otype, olen, d)
- if (otype == DHCPV6_OPT_IA_PREFIX)
- have_pd = true;
+ dhcpv6_for_each_option(&h[1], oend, otype, olen, d) {
+ if (otype == DHCPV6_OPT_IA_PREFIX && (olen + 4) >=
+ (uint16_t)sizeof(struct dhcpv6_ia_prefix)) {
+ struct dhcpv6_ia_prefix *p = (struct dhcpv6_ia_prefix*)&odata[-4];
+ have_pd = p->prefix;
+ }
+ }