From: Ben Hutchings <ben@decadent.org.uk>
Date: Thu, 28 Jan 2016 22:45:39 +0000 (+0000)
Subject: Fix end pointer passed from dhcpv6_handle_reply() to dhcpv6_parse_ia()
X-Git-Tag: debian/1.1+git20160131-1~6^2
X-Git-Url: https://git.decadent.org.uk/gitweb/?a=commitdiff_plain;h=c47e4f59ef87ef94b84023e260bfadd9df6e5a82;p=odhcp6c.git

Fix end pointer passed from dhcpv6_handle_reply() to dhcpv6_parse_ia()

The end of the IA option is odata + olen; there's no need to add anything.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---

diff --git a/src/dhcpv6.c b/src/dhcpv6.c
index e27d899..c5f11f1 100644
--- a/src/dhcpv6.c
+++ b/src/dhcpv6.c
@@ -989,7 +989,7 @@ static int dhcpv6_handle_reply(enum dhcpv6_msg orig, _unused const int rc,
 				if (code != DHCPV6_Success)
 					continue;
 
-				dhcpv6_parse_ia(ia_hdr, odata + olen + sizeof(*ia_hdr));
+				dhcpv6_parse_ia(ia_hdr, odata + olen);
 				passthru = false;
 			} else if (otype == DHCPV6_OPT_STATUS && olen >= 2) {
 				uint8_t *mdata = (olen > 2) ? &odata[2] : NULL;