From b0e7444cfea168b6b283ca89e00b57494e0bced2 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Mon, 10 Aug 2026 09:42:23 +0300 Subject: dhcpv6: fix end pointer of an encapsulated relay message opth->data already points past the option header, so adding sizeof(*opth) again counted it twice and left endptr four bytes beyond the end of the Relay-Message option, and possibly beyond the received packet. The bounds check at the top of the option loop is written against that endptr, so on the next pass it accepted an option header that lies outside the buffer and read opth->len from it. ASan on a Relay-Forward packet: ERROR: AddressSanitizer: heap-buffer-overflow READ of size 2 in dhcpv6_packet_parse dhcpv6_packet.c:158 The end of the relayed message is the option payload, nothing more. --- accel-pppd/ipv6/dhcpv6_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/accel-pppd/ipv6/dhcpv6_packet.c b/accel-pppd/ipv6/dhcpv6_packet.c index c1a57668..1cae30e6 100644 --- a/accel-pppd/ipv6/dhcpv6_packet.c +++ b/accel-pppd/ipv6/dhcpv6_packet.c @@ -164,7 +164,7 @@ struct dhcpv6_packet *dhcpv6_packet_parse(const void *buf, size_t size) if (opth->code == htons(D6_OPTION_RELAY_MSG)) { pkt->hdr = (struct dhcpv6_msg_hdr *)opth->data; - endptr = opth->data + sizeof(*opth) + ntohs(opth->len); + endptr = opth->data + ntohs(opth->len); } ptr += sizeof(*opth) + ntohs(opth->len); -- cgit v1.2.3