From e7e6edb2f8e43085d02cdda93fe16256ab3a35fe Mon Sep 17 00:00:00 2001
From: Spenser Reinhardt <sreinhardt@nagios.com>
Date: Sun, 22 Jun 2014 16:02:19 -0500
Subject: plugins-root/check_dhcp.c - array out of bounds

Coverity 66488 - offer_packet->options has a max size of 312. It was being used in a loop verifying less than 311, but increasing by 2 per loop, causing a possible array index out of bounds. Changed to checking less than max length - 1. - SR
---
 plugins-root/check_dhcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'plugins-root/check_dhcp.c')

diff --git a/plugins-root/check_dhcp.c b/plugins-root/check_dhcp.c
index 1ec5c396..b69a10da 100644
--- a/plugins-root/check_dhcp.c
+++ b/plugins-root/check_dhcp.c
@@ -837,7 +837,7 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){
 		return ERROR;
 
 	/* process all DHCP options present in the packet */
-	for(x=4;x<MAX_DHCP_OPTIONS_LENGTH;){
+	for(x=4;x<MAX_DHCP_OPTIONS_LENGTH-1;){
 
 		if((int)offer_packet->options[x]==-1)
 			break;
-- 
cgit v1.2.3