From 0cb90f97fde1d809f72230537dd18abb3d12a6e2 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 19 Feb 2024 09:30:17 +0900
Subject: [PATCH 0249/1160] sd-radv: fix potential buffer overflow

Fixes a bug in 1925f829ab17cee7d65cc8c350d8281f8f41588e and
6a6d27bc5b08388964118e922f0c1b49b3c6a8ae (v255).

(cherry picked from commit ac63c8df309e37960618610d8b57ac19ac657254)
---
 src/libsystemd-network/sd-radv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c
index 511d06d805..97d306c49b 100644
--- a/src/libsystemd-network/sd-radv.c
+++ b/src/libsystemd-network/sd-radv.c
@@ -146,9 +146,9 @@ static int radv_send(sd_radv *ra, const struct in6_addr *dst, usec_t lifetime_us
                 .nd_opt_mtu_type = ND_OPT_MTU,
                 .nd_opt_mtu_len = 1,
         };
-        /* Reserve iov space for RA header, linkaddr, MTU, N prefixes, N routes, RDNSS
-           and DNSSL */
-        struct iovec iov[5 + ra->n_prefixes + ra->n_route_prefixes];
+        /* Reserve iov space for RA header, linkaddr, MTU, N prefixes, N routes, N pref64 prefixes, RDNSS,
+         * DNSSL, and home agent. */
+        struct iovec iov[6 + ra->n_prefixes + ra->n_route_prefixes + ra->n_pref64_prefixes];
         struct msghdr msg = {
                 .msg_name = &dst_addr,
                 .msg_namelen = sizeof(dst_addr),
-- 
2.33.0