Don't overflow the allocated DHCP response buffer.
authorreyk <reyk@openbsd.org>
Mon, 24 Apr 2017 07:14:27 +0000 (07:14 +0000)
committerreyk <reyk@openbsd.org>
Mon, 24 Apr 2017 07:14:27 +0000 (07:14 +0000)
commitbfa31a59c05c262ffe944cda8d7125b1b0f0b0c7
tree71d0539f504cf2670f4a75f135dba3fbb81de006
parent58c71edf26cfa1d162b0e9e0bcc64b370ff465d1
Don't overflow the allocated DHCP response buffer.

When copying the DHCP/BOOTP response into the allocated buffer, use
the calculated response length instead of the maximum size of a DHCP
packet.  The response length was verified correctly but the very last
step missed to use it.

Found by Caspar Schutijser and malloc.conf(5) "S"

OK deraadt@
usr.sbin/vmd/dhcp.c