Merge pull request #43 from bwhacks/security-fixes

Security/regression fixes

diff --git a/src/dhcpv6.c b/src/dhcpv6.c
index e27d8995a40102a5446816334fb3e3843819e311..c5f11f13141dfeb87c4eff4ddb82890ae49b16c2 100644 (file)
--- a/src/dhcpv6.c
+++ b/src/dhcpv6.c
@@ -989,7 +989,7 @@ static int dhcpv6_handle_reply(enum dhcpv6_msg orig, _unused const int rc,
                                if (code != DHCPV6_Success)
                                        continue;
 
-                               dhcpv6_parse_ia(ia_hdr, odata + olen + sizeof(*ia_hdr));
+                               dhcpv6_parse_ia(ia_hdr, odata + olen);
                                passthru = false;
                        } else if (otype == DHCPV6_OPT_STATUS && olen >= 2) {
                                uint8_t *mdata = (olen > 2) ? &odata[2] : NULL;

diff --git a/src/script.c b/src/script.c
index 1533510dbab56c8d8394298ecf48c844b9255380..b20e94c9460c92ae45312bf48436ad73e0dd2d89 100644 (file)
--- a/src/script.c
+++ b/src/script.c
@@ -173,7 +173,7 @@ static void entry_to_env(const char *name, const void *data, size_t len, enum en
                buf_len += strlen(&buf[buf_len]);
                if (type != ENTRY_HOST) {
                        snprintf(&buf[buf_len], 6, "/%"PRIu16, e[i].length);
-                       buf += strlen(&buf[buf_len]);
+                       buf_len += strlen(&buf[buf_len]);
                        if (type == ENTRY_ROUTE) {
                                buf[buf_len++] = ',';
                                if (!IN6_IS_ADDR_UNSPECIFIED(&e[i].router)) {
@@ -181,15 +181,15 @@ static void entry_to_env(const char *name, const void *data, size_t len, enum en
                                        buf_len += strlen(&buf[buf_len]);
                                }
                                snprintf(&buf[buf_len], 23, ",%u,%u", e[i].valid, e[i].priority);
-                               buf += strlen(&buf[buf_len]);
+                               buf_len += strlen(&buf[buf_len]);
                        } else {
                                snprintf(&buf[buf_len], 23, ",%u,%u", e[i].preferred, e[i].valid);
-                               buf += strlen(&buf[buf_len]);
+                               buf_len += strlen(&buf[buf_len]);
                        }
 
                        if (type == ENTRY_PREFIX && ntohl(e[i].iaid) != 1) {
                                snprintf(&buf[buf_len], 16, ",class=%08x", ntohl(e[i].iaid));
-                               buf += strlen(&buf[buf_len]);
+                               buf_len += strlen(&buf[buf_len]);
                        }
 
                        if (type == ENTRY_PREFIX && e[i].priority) {