dhcpv6: fix end pointer of an encapsulated relay message

opth->data already points past the option header, so adding
sizeof(*opth) again counted it twice and left endptr four bytes beyond
the end of the Relay-Message option, and possibly beyond the received
packet.

The bounds check at the top of the option loop is written against that
endptr, so on the next pass it accepted an option header that lies
outside the buffer and read opth->len from it. ASan on a Relay-Forward
packet:

  ERROR: AddressSanitizer: heap-buffer-overflow
  READ of size 2 in dhcpv6_packet_parse dhcpv6_packet.c:158

The end of the relayed message is the option payload, nothing more.

1 files changed, 1 insertions, 1 deletions

diff --git a/accel-pppd/ipv6/dhcpv6_packet.c b/accel-pppd/ipv6/dhcpv6_packet.c
index c1a57668..1cae30e6 100644
--- a/accel-pppd/ipv6/dhcpv6_packet.c
+++ b/accel-pppd/ipv6/dhcpv6_packet.c
@@ -164,7 +164,7 @@ struct dhcpv6_packet *dhcpv6_packet_parse(const void *buf, size_t size)
 
 			if (opth->code == htons(D6_OPTION_RELAY_MSG)) {
 				pkt->hdr = (struct dhcpv6_msg_hdr *)opth->data;
-				endptr = opth->data + sizeof(*opth) + ntohs(opth->len);
+				endptr = opth->data + ntohs(opth->len);
 			}
 
 			ptr += sizeof(*opth) + ntohs(opth->len);