From 828b603a791edd04a5c3603456aa8caca44ce67e Mon Sep 17 00:00:00 2001 From: =?utf8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 14 Apr 2021 04:55:09 -0400 Subject: [PATCH] libsystemd-network: fix dhcp option buffer confusion We were writing to the wrong buffer with a wrong offset :( Bug present since the original introduction of the code in 04b28be1a306fd2ba454d3ee333d63df71aa3873. --- src/libsystemd-network/dhcp-option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libsystemd-network/dhcp-option.c b/src/libsystemd-network/dhcp-option.c index faa075cbd7..8899e8a552 100644 --- a/src/libsystemd-network/dhcp-option.c +++ b/src/libsystemd-network/dhcp-option.c @@ -17,6 +17,7 @@ static int option_append(uint8_t options[], size_t size, size_t *offset, uint8_t code, size_t optlen, const void *optval) { assert(options); + assert(size > 0); assert(offset); if (code != SD_DHCP_OPTION_END) @@ -165,7 +166,7 @@ int dhcp_option_append(DHCPMessage *message, size_t size, size_t *offset, } else if (r == -ENOBUFS && use_sname) { /* did not fit, but we have more buffers to try close the file array and move the offset to its end */ - r = option_append(message->options, size, offset, SD_DHCP_OPTION_END, 0, NULL); + r = option_append(message->file, sizeof(message->file), &file_offset, SD_DHCP_OPTION_END, 0, NULL); if (r < 0) return r; -- 2.25.1