From 33a8fc97ef35e898b45d3331c1d3f01411fd3107 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Thu, 12 Mar 2026 13:23:48 +0100 Subject: [PATCH 2/2] udhcpc6: check the size of D6_OPT_IAPREFIX option function old new delta option_to_env 694 711 +17 Signed-off-by: Denys Vlasenko (cherry picked from commit d368f3f7836d1c2484c8f839316e5c93e76d4409) --- networking/udhcp/d6_dhcpc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c index 661708f11..944644452 100644 --- a/networking/udhcp/d6_dhcpc.c +++ b/networking/udhcp/d6_dhcpc.c @@ -287,8 +287,8 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) * | valid-lifetime | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ - /* Make sure payload contains an address */ - if (option[3] < 24) + /* Make sure payload exists */ + if (option[3] < (16 + 4 + 4)) break; sprint_nip6(ipv6str, option + 4); @@ -331,6 +331,9 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) * | | * +-+-+-+-+-+-+-+-+ */ + /* Make sure payload exists */ + if (option[3] < (4 + 4 + 1 + 16)) + break; move_from_unaligned32(v32, option + 4 + 4); *new_env() = xasprintf("ipv6prefix_lease=%u", (unsigned)v32); -- 2.53.0