Drop DHCPv6 messages containing invalid option length

diff --git a/src/dhcpv6.c b/src/dhcpv6.c
index cd8e43800dca33315047cd000262a5697c985be5..8d65219eb8d4ccfe073ab214750aef49f9f9380a 100644 (file)
--- a/src/dhcpv6.c
+++ b/src/dhcpv6.c
@@ -623,7 +623,7 @@ static bool dhcpv6_response_is_valid(const void *buf, ssize_t len,
                }
        }
 
-       if (!options_valid)
+       if (!options_valid || ((odata + olen) > end))
                return false;
 
        if (type == DHCPV6_MSG_INFO_REQ && ia_present)