dhcpv4: fix out of bound access in dhcpv4_put
authorHans Dedecker <dedeckeh@gmail.com>
Mon, 7 May 2018 15:59:47 +0000 (17:59 +0200)
committerHans Dedecker <dedeckeh@gmail.com>
Mon, 7 May 2018 16:01:15 +0000 (18:01 +0200)
Detected by Coverity in CID 1433363 and 1432121

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
src/dhcpv4.c

index 81e537d..88727ac 100644 (file)
@@ -241,7 +241,9 @@ static void dhcpv4_put(struct dhcpv4_message *msg, uint8_t **cookie,
                uint8_t type, uint8_t len, const void *data)
 {
        uint8_t *c = *cookie;
-       if (*cookie + 2 + len > (uint8_t*)&msg[1])
+       uint8_t *end = (uint8_t *)msg + sizeof(*msg);
+
+       if (*cookie + 2 + len > end)
                return;
 
        *c++ = type;