From d3157f2a67fc0263933200beb2f23cdcc2897dc0 Mon Sep 17 00:00:00 2001 From: Siteshwar Vashisht Date: Thu, 10 Sep 2026 11:04:14 +0200 Subject: [PATCH] ndisc: fix an off by 2 write in ndisc_option_build_encrypted_dns() This function constructs the NDisc Encrypted DNS option (RFC 9463). `poff` is initialized to `off + sizeof(uint16_t)` - pointing past the 2 bytes SvcParam length field. After all SvcParams are written the length is set at line 1541. `LESS_BY(poff, off) = poff - off` includes the 2 bytes length field itself. The correct value is `poff - off - sizeof(uint16_t)`. --- src/libsystemd-network/ndisc-option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libsystemd-network/ndisc-option.c b/src/libsystemd-network/ndisc-option.c index 57418c0064..92e04bb997 100644 --- a/src/libsystemd-network/ndisc-option.c +++ b/src/libsystemd-network/ndisc-option.c @@ -1538,7 +1538,7 @@ static int ndisc_option_build_encrypted_dns(const sd_ndisc_option *option, usec_ poff += plen; } - unaligned_write_be16(buf + off, LESS_BY(poff, off)); + unaligned_write_be16(buf + off, LESS_BY(poff, off + sizeof(uint16_t))); off = poff; padding: