summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorDenys Fedoryshchenko <denys.f@collabora.com>2026-08-10 08:32:47 +0300
committerDenys Fedoryshchenko <denys.f@collabora.com>2026-08-10 08:32:47 +0300
commit6019e1d14937731be7c88628fc7c1253aaa701e7 (patch)
treec10471271d404cd8897a380b574a3ce62a112305 /drivers
parent1719b4ab756158f4a102bcf5036ff250d67ed015 (diff)
downloadaccel-ppp-6019e1d14937731be7c88628fc7c1253aaa701e7.tar.gz
accel-ppp-6019e1d14937731be7c88628fc7c1253aaa701e7.zip
dhcpv6: fix status code name table and its bounds check
A missing comma made "UseMulticast" and "NoPrefixAvail" concatenate into a single string literal, so the table held 6 entries instead of 7: UseMulticast printed as "UseMulticastNoPrefixAvail" and NoPrefixAvail had no entry at all. The bounds check compared the status code against sizeof(status_name), which is the size of the table in bytes (48), not its number of entries. Codes 6..48 passed the check and indexed past the end of the table, so print() was handed whatever pointer-sized garbage followed it. A client can trigger this by sending a Status Code option with an out-of-range code, which is printed verbatim when verbose is enabled. Compare against the entry count instead, and drop the ntohs() < 0 test, which can never be true for an unsigned value.
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions