SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ndisc: fix an off by 2 write in ndisc_option_build_encrypted_dns()

Browse Source 
This function constructs the NDisc Encrypted DNS option (RFC 9463).
`poff` is initialized to `off + sizeof(uint16_t)` - pointing past the 2
bytes SvcParam length field. After all SvcParams are written the length
is set at line 1541. `LESS_BY(poff, off) = poff - off` includes the 2
bytes length field itself. The correct value is `poff - off -
sizeof(uint16_t)`.

(cherry picked from commit d3157f2a67)
This commit is contained in:
Siteshwar Vashisht
2026-10-16 11:36:32 +01:00
committed by Luca Boccassi
parent 43cd0e4004
commit 69b915a059
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsystemd-network/ndisc-option.c
+1 -1
View File
@@ -1538,7 +1538,7 @@ static int ndisc_option_build_encrypted_dns(const sd_ndisc_option *option, usec_
poff += plen;
}
unaligned_write_be16(buf + off, LESS_BY(poff, off));
unaligned_write_be16(buf + off, LESS_BY(poff, off + sizeof(uint16_t)));
off = poff;
padding: