[Dnsmasq-discuss] [PATCH] lease-tools: parse IA_NA suboptions after fixed fields

[Mikhail Dmitrichenko]

The DHCPv6 IA_NA option has a 12 byte fixed header made up of IAID, T1 
and T2. dhcp_release6 currently treats the fixed part as 24 bytes, 
which is the size of an IAADDR payload instead.

This makes the parser skip past the start of the IA_NA suboption area 
and reject valid IA_NA options shorter than 24 bytes. Parse IA_NA 
suboptions after the 12 byte fixed part and only require that minimum 
length before subtracting it from option_len.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222 at gmail.com>
---
 contrib/lease-tools/dhcp_release6.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/lease-tools/dhcp_release6.c b/contrib/lease-tools/dhcp_release6.c
index bbdd412..a795a35 100644
--- a/contrib/lease-tools/dhcp_release6.c
+++ b/contrib/lease-tools/dhcp_release6.c
@@ -339,10 +339,10 @@ int16_t parse_packet(char* buf, size_t len)
 
       if (option_type == IA_NA )
 	{
-	  if (option_len < 24)
+	  if (option_len < 12)
 	    return UNSPEC_FAIL;
 
-	  uint16_t result = parse_iana_suboption(buf + current_pos +24, option_len -24);
+	  uint16_t result = parse_iana_suboption(buf + current_pos + 12, option_len - 12);
 	  if (result)
 	    return result;
 	}
-- 
2.54.0.windows.1