From 46bdfe691adb10cad34c00c3389412980739e09b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sun, 8 Mar 2020 15:56:19 +0000 Subject: [PATCH] Fix error in IPv6 prefix calculation. Error with prefixed address assignment. When it is calculating number of addresses from prefixlen, it rotates only 32bit int instead of 64b uint. Only result is assigned to 64b variable. Two examples: dhcp-host=[2000::1230:0:0/92],correct-prefix dhcp-host=[2000::1234:5678:0/92],incorrect-prefix If prefix length is lower than 96, the result is zero. It means incorrect-prefix is not refused as it should. Fix is simple, attaching patch with it. Just rotate 64b int. --- src/option.c | 2 +- src/rfc3315.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/option.c b/src/option.c index 3052a4d..9ffd7fc 100644 --- a/src/option.c +++ b/src/option.c @@ -3322,7 +3322,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma if (!atoi_check(pref, &new_addr->prefixlen) || new_addr->prefixlen > 128 || - (((1<<(128-new_addr->prefixlen))-1) & addrpart) != 0) + ((((u64)1<<(128-new_addr->prefixlen))-1) & addrpart) != 0) { dhcp_config_free(new); ret_err(_("bad IPv6 prefix")); diff --git a/src/rfc3315.c b/src/rfc3315.c index 57f3f8b..b3f0a0a 100644 --- a/src/rfc3315.c +++ b/src/rfc3315.c @@ -1731,7 +1731,7 @@ static int config_valid(struct dhcp_config *config, struct dhcp_context *context addresses = 1; if (addr_list->flags & ADDRLIST_PREFIX) - addresses = 1<<(128-addr_list->prefixlen); + addresses = (u64)1<<(128-addr_list->prefixlen); if ((addr_list->flags & ADDRLIST_WILDCARD)) {