udhcpc: fix OPTION_6RD parsing (could overflow its malloced buffer)

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index 48097bc24..2fe84e1ca 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -113,7 +113,7 @@ static const uint8_t len_of_option_as_string[] = {
         [OPTION_IP              ] = sizeof("255.255.255.255 "),
         [OPTION_IP_PAIR         ] = sizeof("255.255.255.255 ") * 2,
         [OPTION_STATIC_ROUTES   ] = sizeof("255.255.255.255/32 255.255.255.255 "),
-        [OPTION_6RD             ] = sizeof("32 128 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 255.255.255.255 "),
+        [OPTION_6RD             ] = sizeof("132 128 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 255.255.255.255 "),
         [OPTION_STRING          ] = 1,
         [OPTION_STRING_HOST     ] = 1,
 #if ENABLE_FEATURE_UDHCP_RFC3397
@@ -222,7 +222,7 @@ static NOINLINE char *xmalloc_optname_optval(uint8_t *option, const struct dhcp_
         type = optflag->flags & OPTION_TYPE_MASK;
         optlen = dhcp_option_lengths[type];
         upper_length = len_of_option_as_string[type]
-                * ((unsigned)(len + optlen - 1) / (unsigned)optlen);
+                * ((unsigned)(len + optlen) / (unsigned)optlen);
 
         dest = ret = xmalloc(upper_length + strlen(opt_name) + 2);
         dest += sprintf(ret, "%s=", opt_name);