diff options
Diffstat (limited to 'common/options.c')
| -rw-r--r-- | common/options.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/common/options.c b/common/options.c index 80fd8db..e485222 100644 --- a/common/options.c +++ b/common/options.c @@ -3,7 +3,7 @@ DHCP options parsing and reassembly. */ /* - * Copyright (c) 2004-2011 by Internet Systems Consortium, Inc. ("ISC") + * Copyright (c) 2004-2012 by Internet Systems Consortium, Inc. ("ISC") * Copyright (c) 1995-2003 by Internet Software Consortium * * Permission to use, copy, modify, and distribute this software for any @@ -2361,7 +2361,7 @@ prepare_option_buffer(struct universe *universe, struct buffer *bp, cleanup: option_dereference(&option, MDL); - return 1; + return status; } static void @@ -3845,6 +3845,7 @@ do_packet6(struct interface_info *interface, const char *packet, msg_type = packet[0]; if ((msg_type == DHCPV6_RELAY_FORW) || (msg_type == DHCPV6_RELAY_REPL)) { + int relaylen = (int)(offsetof(struct dhcpv6_relay_packet, options)); relay = (const struct dhcpv6_relay_packet *)packet; decoded_packet->dhcpv6_msg_type = relay->msg_type; @@ -3856,7 +3857,7 @@ do_packet6(struct interface_info *interface, const char *packet, relay->peer_address, sizeof(relay->peer_address)); if (!parse_option_buffer(decoded_packet->options, - relay->options, len-sizeof(*relay), + relay->options, len - relaylen, &dhcpv6_universe)) { /* no logging here, as parse_option_buffer() logs all cases where it fails */ @@ -3864,6 +3865,7 @@ do_packet6(struct interface_info *interface, const char *packet, return; } } else { + int msglen = (int)(offsetof(struct dhcpv6_packet, options)); msg = (const struct dhcpv6_packet *)packet; decoded_packet->dhcpv6_msg_type = msg->msg_type; @@ -3873,7 +3875,7 @@ do_packet6(struct interface_info *interface, const char *packet, sizeof(decoded_packet->dhcpv6_transaction_id)); if (!parse_option_buffer(decoded_packet->options, - msg->options, len-sizeof(*msg), + msg->options, len - msglen, &dhcpv6_universe)) { /* no logging here, as parse_option_buffer() logs all cases where it fails */ |