Fix potential invalid memory access

diff --git a/src/dhcpv4.c b/src/dhcpv4.c
index 04ef182472d1945e92c0b87388096947010aff64..647cdc0f53d49476fe81b06108c5c6789b9c652d 100644 (file)
--- a/src/dhcpv4.c
+++ b/src/dhcpv4.c
@@ -637,7 +637,7 @@ static struct dhcpv4_assignment* dhcpv4_lease(struct interface *iface,
        } else if (msg == DHCPV4_MSG_RELEASE) {
                if (a && a->valid_until != LONG_MAX)
                        a->valid_until = 0;
-       } else if (msg == DHCPV4_MSG_DECLINE && a->valid_until != LONG_MAX) {
+       } else if (msg == DHCPV4_MSG_DECLINE && a && a->valid_until != LONG_MAX) {
                memset(a->hwaddr, 0, sizeof(a->hwaddr));
                a->valid_until = now + 3600; // Block address for 1h
        }

diff --git a/src/dhcpv6-ia.c b/src/dhcpv6-ia.c
index de445816116693d0aa70343a2a9fc75fcfcfa7e8..1476e021a590d713d4882c94bc2771e2a2f35b50 100644 (file)
--- a/src/dhcpv6-ia.c
+++ b/src/dhcpv6-ia.c
@@ -596,7 +596,10 @@ static void update(struct interface *iface)
        }
 
        struct dhcpv6_assignment *border = list_last_entry(&iface->ia_assignments, struct dhcpv6_assignment, head);
-       border->assigned = 1 << (64 - minprefix);
+       if (minprefix <= 32 || minprefix > 64)
+               border->assigned = 1U << (64 - minprefix);
+       else
+               border->assigned = 0;
 
        bool change = len != (int)iface->ia_addr_len;
        for (int i = 0; !change && i < len; ++i)