From: Steven Barth <steven@midlink.org>
Date: Fri, 29 Jan 2016 06:10:51 +0000 (+0100)
Subject: Merge pull request #43 from bwhacks/security-fixes
X-Git-Tag: debian/1.1+git20160131-1~6
X-Git-Url: https://git.decadent.org.uk/gitweb/?p=odhcp6c.git;a=commitdiff_plain;h=3609bab1361ed3f92e19f7309dd6e7fd64bc4083;hp=51541450f9970075f2e8a7d6112336e1cf93ab10

Merge pull request #43 from bwhacks/security-fixes

Security/regression fixes
---

diff --git a/src/dhcpv6.c b/src/dhcpv6.c
index e27d899..c5f11f1 100644
--- a/src/dhcpv6.c
+++ b/src/dhcpv6.c
@@ -989,7 +989,7 @@ static int dhcpv6_handle_reply(enum dhcpv6_msg orig, _unused const int rc,
 				if (code != DHCPV6_Success)
 					continue;
 
-				dhcpv6_parse_ia(ia_hdr, odata + olen + sizeof(*ia_hdr));
+				dhcpv6_parse_ia(ia_hdr, odata + olen);
 				passthru = false;
 			} else if (otype == DHCPV6_OPT_STATUS && olen >= 2) {
 				uint8_t *mdata = (olen > 2) ? &odata[2] : NULL;
diff --git a/src/script.c b/src/script.c
index 1533510..b20e94c 100644
--- a/src/script.c
+++ b/src/script.c
@@ -173,7 +173,7 @@ static void entry_to_env(const char *name, const void *data, size_t len, enum en
 		buf_len += strlen(&buf[buf_len]);
 		if (type != ENTRY_HOST) {
 			snprintf(&buf[buf_len], 6, "/%"PRIu16, e[i].length);
-			buf += strlen(&buf[buf_len]);
+			buf_len += strlen(&buf[buf_len]);
 			if (type == ENTRY_ROUTE) {
 				buf[buf_len++] = ',';
 				if (!IN6_IS_ADDR_UNSPECIFIED(&e[i].router)) {
@@ -181,15 +181,15 @@ static void entry_to_env(const char *name, const void *data, size_t len, enum en
 					buf_len += strlen(&buf[buf_len]);
 				}
 				snprintf(&buf[buf_len], 23, ",%u,%u", e[i].valid, e[i].priority);
-				buf += strlen(&buf[buf_len]);
+				buf_len += strlen(&buf[buf_len]);
 			} else {
 				snprintf(&buf[buf_len], 23, ",%u,%u", e[i].preferred, e[i].valid);
-				buf += strlen(&buf[buf_len]);
+				buf_len += strlen(&buf[buf_len]);
 			}
 
 			if (type == ENTRY_PREFIX && ntohl(e[i].iaid) != 1) {
 				snprintf(&buf[buf_len], 16, ",class=%08x", ntohl(e[i].iaid));
-				buf += strlen(&buf[buf_len]);
+				buf_len += strlen(&buf[buf_len]);
 			}
 
 			if (type == ENTRY_PREFIX && e[i].priority) {