X-Git-Url: http://git.ozlabs.org/?p=yaboot.git;a=blobdiff_plain;f=second%2Fprom.c;h=d48ede52b071025e12a5514f8e604d89c5e9e400;hp=4ad727761b47a58f2a6b47869df912dd3de04df4;hb=f91756b6306e4da8aef013c8b375b32c2c0c3a2f;hpb=0df88bef1fd2fb7bba04a7381bd8fe05ee2b230c

diff --git a/second/prom.c b/second/prom.c
index 4ad7277..d48ede5 100644
--- a/second/prom.c
+++ b/second/prom.c
@@ -683,6 +683,10 @@ struct bootp_packet * prom_get_netinfo (void)
      void *bootp_response = NULL;
      char *propname;
      struct bootp_packet *packet;
+     /* struct bootp_packet contains a VLA, so sizeof won't work.
+        the VLA /must/ be the last field in the structure so use it's
+        offset as a good estimate of the packet size */
+     size_t packet_size = offsetof(struct bootp_packet, options);
      int i = 0, size, offset = 0;
      prom_handle chosen;
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof(x[0]))
@@ -707,7 +711,7 @@ struct bootp_packet * prom_get_netinfo (void)
      if (size <= 0)
          return NULL;
 
-     if (sizeof(*packet) > size - offset) {
+     if (packet_size > size - offset) {
          prom_printf("Malformed %s property?\n", propname);
          return NULL;
      }