From 42202bfb1e6ac51fa995beda8be4d7b654aeee2a Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Thu, 12 Mar 2026 07:25:38 +0100 Subject: [PATCH 1/2] udhcpc6: fix buffer overflow Signed-off-by: Denys Vlasenko --- networking/udhcp/d6_dhcpc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c index f17a12151..5f81c7c6b 100644 --- a/networking/udhcp/d6_dhcpc.c +++ b/networking/udhcp/d6_dhcpc.c @@ -369,15 +369,15 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) addrs = option[3] >> 4; /* Setup environment variable */ - *new_env() = dlist = xmalloc(4 + addrs * 40 - 1); + *new_env() = dlist = xmalloc(4 + addrs * 40 + 1); dlist = stpcpy(dlist, "dns="); option_offset = 0; - while (addrs--) { + while (addrs-- != 0) { sprint_nip6(dlist, option + 4 + option_offset); dlist += 39; option_offset += 16; - if (addrs) + if (addrs != 0) *dlist++ = ' '; } -- 2.53.0