From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Thu, 27 Sep 2018 14:48:51 +0000 (+0900)
Subject: dhcp6: fix buffer size checking
X-Git-Tag: v240~671^2~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=cb1bdeaf56852275e6b0dd1fba932bb174767f70;p=platform%2Fupstream%2Fsystemd.git

dhcp6: fix buffer size checking
---

diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c
index 6e7ccce..7899436 100644
--- a/src/libsystemd-network/sd-dhcp6-client.c
+++ b/src/libsystemd-network/sd-dhcp6-client.c
@@ -844,8 +844,8 @@ static int client_parse_message(
                 uint8_t *optval;
                 be32_t iaid_lease;
 
-                if (len < offsetof(DHCP6Option, data) ||
-                    len < offsetof(DHCP6Option, data) + be16toh(option->len))
+                if (len < pos + offsetof(DHCP6Option, data) ||
+                    len < pos + offsetof(DHCP6Option, data) + be16toh(option->len))
                         return -ENOBUFS;
 
                 optcode = be16toh(option->code);