dhcpv6: fix out of bounds write in handle_nested_message()

Detected by Coverity in CID1412413

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>

diff --git a/src/dhcpv6.c b/src/dhcpv6.c
index 4e7d0d014b29a7b5b3454aaa00aba3525b6d5b2b..554939459c2f8c4c3e7b6e60733d8036422d2a2b 100644 (file)
--- a/src/dhcpv6.c
+++ b/src/dhcpv6.c
@@ -174,7 +174,7 @@ enum {
 };
 
 static void handle_nested_message(uint8_t *data, size_t len,
-               uint8_t **opts, uint8_t **end, struct iovec iov[IOV_TOTAL - 1])
+               uint8_t **opts, uint8_t **end, struct iovec iov[IOV_TOTAL])
 {
        struct dhcpv6_relay_header *hdr = (struct dhcpv6_relay_header*)data;
        if (iov[IOV_NESTED].iov_base == NULL) {